Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1427905
MD5:	265d5b8b9f603f0f5ef62f2c27449607
SHA1:	39576d6d8388dea489946141dbccf9cf5fe3a28f
SHA256:	948d096a3931a22f116b93ffeefb3a374834d8eb578620c0ffc83f3e468eed81
Tags:	exe
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Country aware sample found (crashes after keyboard check)

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 265D5B8B9F603F0F5EF62F2C27449607)

schtasks.exe (PID: 7396 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7444 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7548 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 784 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7720 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 960 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7832 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1008 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7928 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 996 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8060 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1020 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8140 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1416 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6580 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1828 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5480 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1848 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7524 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1808 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5852 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1940 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7712 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1948 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 7584 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 265D5B8B9F603F0F5EF62F2C27449607)

MPGPH131.exe (PID: 7592 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 265D5B8B9F603F0F5EF62F2C27449607)

RageMP131.exe (PID: 7988 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 265D5B8B9F603F0F5EF62F2C27449607)

WerFault.exe (PID: 7440 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 820 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7656 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 940 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 736 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 952 MD5: C31336C1EFC2CCB44B4326EA793040F2)

RageMP131.exe (PID: 2352 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 265D5B8B9F603F0F5EF62F2C27449607)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\dSyaNbAby9QXs4RBu3VN33H.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\e_uwnYJDOrnylP4tGD1vKSo.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\OfCx6VeglYVpWTwI9NddWAo.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000003.2305959394.0000000003058000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2307637364.0000000007A99000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000011.00000002.2350759257.0000000004A1C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.2253726342.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2258287784.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.2603079344.0000000002F47000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000011.00000003.2343081719.0000000003065000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.2345569703.0000000004A60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2256177341.000000000302E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2256109726.0000000002F51000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.1698876622.0000000004C20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000011.00000002.2352946266.0000000007A40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000011.00000003.1935064684.0000000004C30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000011.00000002.2350560658.0000000003069000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2555380044.0000000002FCE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000011.00000003.2307237063.0000000003058000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001A.00000002.2604404588.0000000007A40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000011.00000002.2348884384.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000011.00000002.2345301493.0000000000400000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000003.2355371299.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001A.00000002.2603730581.0000000004A22000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.2554245395.0000000002F65000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000002.2552333219.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001A.00000002.2601441093.0000000000400000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.2552258510.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001A.00000003.2050121383.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: file.exe PID: 7328	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7584	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7592	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7988	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7988	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 2352	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 2352	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 43 entries

Unpacked PEs

Source	Rule	Description	Author
8.3.MPGPH131.exe.4a60000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0.2.file.exe.4ac0e67.1.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
26.2.RageMP131.exe.400000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
8.2.MPGPH131.exe.400000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
9.3.MPGPH131.exe.4a10000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
17.2.RageMP131.exe.400000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
26.3.RageMP131.exe.4c40000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
9.2.MPGPH131.exe.400000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
8.2.MPGPH131.exe.400000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
9.2.MPGPH131.exe.48b0e67.1.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
26.2.RageMP131.exe.400000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
17.2.RageMP131.exe.4ad0e67.1.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
26.2.RageMP131.exe.4ae0e67.1.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0.2.file.exe.400000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
17.2.RageMP131.exe.400000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
9.2.MPGPH131.exe.400000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
8.2.MPGPH131.exe.4900e67.1.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0.2.file.exe.400000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0.3.file.exe.4c20000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
17.3.RageMP131.exe.4c30000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 7328, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/18/24-10:30:16.680980
SID:	2046269
Source Port:	49740
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-10:29:08.862568
SID:	2046267
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-10:29:04.926205
SID:	2046266
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/18/24-10:29:38.779297
SID:	2046269
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/18/24-10:30:10.701508
SID:	2046269
Source Port:	49746
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/18/24-10:30:15.638714
SID:	2046269
Source Port:	49747
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/18/24-10:29:04.737548
SID:	2049060
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/18/24-10:30:04.701296
SID:	2046269
Source Port:	49739
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-10:29:35.017563
SID:	2046267
Source Port:	58709
Destination Port:	49739
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-10:30:09.489545
SID:	2046266
Source Port:	58709
Destination Port:	49747
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-10:29:31.522217
SID:	2046266
Source Port:	58709
Destination Port:	49739
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-10:29:40.034897
SID:	2046266
Source Port:	58709
Destination Port:	49740
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-10:30:07.590057
SID:	2046266
Source Port:	58709
Destination Port:	49746
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-10:30:11.578830
SID:	2046267
Source Port:	58709
Destination Port:	49746
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-10:30:11.622681
SID:	2046267
Source Port:	58709
Destination Port:	49747
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://193.233.132.167/cost/lenin.exe

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Avira: detection malicious, Label: HEUR/AGEN.1310450

Multi AV Scanner detection for domain / URL

Source: http://147.45.47.102:57893/hera/amadka.exe	Virustotal: Detection: 15%	Perma Link
Source: http://193.233.132.167/cost/go.exe	Virustotal: Detection: 24%	Perma Link
Source: http://193.233.132.167/cost/go.exee	Virustotal: Detection: 23%	Perma Link
Source: http://193.233.132.167/cost/lenin.exe192.168.0	Virustotal: Detection: 24%	Perma Link
Source: http://193.233.132.167/cost/go.exero	Virustotal: Detection: 23%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 47%
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Virustotal: Detection: 47%	Perma Link
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Virustotal: Detection: 47%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

Machine Learning detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041F3EB CryptUnprotectData,LocalFree,		0_2_0041F3EB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041F3EB CryptUnprotectData,LocalFree,		8_2_0041F3EB

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 17.2.RageMP131.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 26.2.RageMP131.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49751 version: TLS 1.2

Source:	Binary string: C:\kiyecatuvoxule\xawip-har\kizipinayuzeh.pdb source: file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr
Source:	Binary string: (C:\kiyecatuvoxule\xawip-har\kizipinayuzeh.pdb source: file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E7B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	0_2_0040E7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DB1CB FindClose,FindFirstFileExW,GetLastError,	0_2_004DB1CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040B300 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_0040B300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041FA10 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_0041FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043EAEB FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CopyFileA,CopyFileA,	0_2_0043EAEB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040E7B0 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	8_2_0040E7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043CA90 CreateThread,CredEnumerateA,SHGetFolderPathA,CreateThread,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CopyFileA,CopyFileA,	8_2_0043CA90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DB1CB FindClose,FindFirstFileExW,GetLastError,	8_2_004DB1CB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DB251 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	8_2_004DB251
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040B300 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	8_2_0040B300

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49730 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49730 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49739
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49739 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49739
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49740
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49740 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49746
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49747
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49746 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49746
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49747
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49747 -> 147.45.47.93:58709

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 147.45.47.93:58709

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 147.45.47.93 147.45.47.93
Source: Joe Sandbox View	IP Address: 104.26.4.15 104.26.4.15

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041E220 recv,setsockopt,recv,WSAGetLastError,recv,recv,setsockopt,recv,recv,recv,__Xtime_get_ticks,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,Sleep,Sleep,

0_2_0041E220

Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown

DNS traffic detected: queries for: ipinfo.io

Source: RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe.52
Source: RageMP131.exe, 00000011.00000002.2353080317.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2343251890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeDatae
Source: file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe_prof
Source: RageMP131.exe, 0000001A.00000003.2600149129.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604583006.0000000007A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exedatD
Source: file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600149129.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604583006.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe
Source: RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exee
Source: file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exeoinxs
Source: RageMP131.exe, 0000001A.00000003.2600149129.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604583006.0000000007A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exero
Source: file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2353080317.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2343251890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600149129.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604583006.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe
Source: RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe192.168.0
Source: RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exepro_botF
Source: file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exese
Source: RageMP131.exe, 0000001A.00000003.2600149129.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604583006.0000000007A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe~
Source: MPGPH131.exe, 00000009.00000002.2554347578.0000000002EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mtO
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, file.exe, 00000000.00000003.1698876622.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2345569703.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2552258510.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.2355371299.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2552333219.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.1935064684.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2345301493.0000000000400000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000001A.00000002.2601441093.0000000000400000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000001A.00000003.2050121383.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: file.exe, 00000000.00000003.1698876622.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2345569703.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2552258510.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.2355371299.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2552333219.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.1935064684.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2345301493.0000000000400000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000001A.00000002.2601441093.0000000000400000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000001A.00000003.2050121383.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllDpRTpR
Source: file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MPGPH131.exe, 00000008.00000002.2554428927.0000000003128000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002EAC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: MPGPH131.exe, 00000008.00000002.2554428927.0000000003128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/?
Source: file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030E9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.0000000003128000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002E58000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002EAC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FA7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52
Source: MPGPH131.exe, 00000009.00000002.2554347578.0000000002EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.525w
Source: RageMP131.exe, 00000011.00000002.2348884384.0000000002FDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52gQ
Source: MPGPH131.exe, 00000008.00000002.2554428927.0000000003128000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52j
Source: MPGPH131.exe, 00000009.00000002.2554347578.0000000002EAC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52
Source: MPGPH131.exe, 00000008.00000002.2554428927.00000000030E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52D)
Source: file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52r
Source: file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, file.exe, 00000000.00000002.2256177341.000000000305D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072010146.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.000000000307B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000008.00000002.2554428927.00000000030E9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030CF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030A0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.0000000003128000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002E30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002EAC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2348884384.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: file.exe, 00000000.00000002.2256177341.00000000030A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072010146.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030E9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349974931.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000002FFD000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000002FFD000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: file.exe, 00000000.00000003.1698876622.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2345569703.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2552258510.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.2355371299.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2552333219.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.1935064684.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2345301493.0000000000400000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000001A.00000002.2601441093.0000000000400000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000001A.00000003.2050121383.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: MPGPH131.exe, 00000009.00000002.2554347578.0000000002E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/n
Source: file.exe, 00000000.00000002.2256177341.000000000307B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/t
Source: file.exe, 00000000.00000002.2256177341.00000000030A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.000000000307B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030AA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002E40000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2348884384.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2306068480.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307548661.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349881372.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2312025857.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2308251432.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002F95000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52
Source: MPGPH131.exe, 00000009.00000002.2554347578.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52$v
Source: MPGPH131.exe, 00000008.00000002.2554428927.00000000030AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52.tmpW
Source: MPGPH131.exe, 00000008.00000002.2554428927.00000000030E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52H)
Source: RageMP131.exe, 0000001A.00000002.2603079344.0000000002FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/~
Source: file.exe, 00000000.00000002.2256177341.00000000030A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030E9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2306068480.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307548661.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349881372.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2312025857.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2308251432.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: RageMP131.exe, 00000011.00000003.2207015077.0000000007ABD000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2465348973.0000000007AB3000.00000004.00000020.00020000.00000000.sdmp, LZlzsFoefEVpHistory.17.dr, d4QTaPGdbj7gHistory.17.dr, MBSHfyCuKHxNHistory.26.dr, IcPAi7xok6iaHistory.0.dr, QkoBCD2tTFlpHistory.0.dr, GUahzsMvIC8wHistory.26.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: LZlzsFoefEVpHistory.17.dr, d4QTaPGdbj7gHistory.17.dr, MBSHfyCuKHxNHistory.26.dr, IcPAi7xok6iaHistory.0.dr, QkoBCD2tTFlpHistory.0.dr, GUahzsMvIC8wHistory.26.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: RageMP131.exe, 00000011.00000003.2207015077.0000000007ABD000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2465348973.0000000007AB3000.00000004.00000020.00020000.00000000.sdmp, LZlzsFoefEVpHistory.17.dr, d4QTaPGdbj7gHistory.17.dr, MBSHfyCuKHxNHistory.26.dr, IcPAi7xok6iaHistory.0.dr, QkoBCD2tTFlpHistory.0.dr, GUahzsMvIC8wHistory.26.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: LZlzsFoefEVpHistory.17.dr, d4QTaPGdbj7gHistory.17.dr, MBSHfyCuKHxNHistory.26.dr, IcPAi7xok6iaHistory.0.dr, QkoBCD2tTFlpHistory.0.dr, GUahzsMvIC8wHistory.26.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: MPGPH131.exe, 00000009.00000002.2554347578.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.G
Source: RageMP131.exe, 0000001A.00000002.2604404588.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, dSyaNbAby9QXs4RBu3VN33H.zip.17.dr, e_uwnYJDOrnylP4tGD1vKSo.zip.0.dr, OfCx6VeglYVpWTwI9NddWAo.zip.26.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: RageMP131.exe, 00000011.00000003.2307637364.0000000007A99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT$
Source: RageMP131.exe, 00000011.00000002.2352946266.0000000007A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTR
Source: MPGPH131.exe, 00000008.00000002.2554428927.000000000306E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTS)
Source: RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2568774506.0000000007AFA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604404588.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr, passwords.txt.26.dr, passwords.txt.17.dr	String found in binary or memory: https://t.me/risepro_bot
Source: file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot.
Source: MPGPH131.exe, 00000009.00000002.2554347578.0000000002EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot1.181.57.52
Source: file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botW
Source: RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlater
Source: MPGPH131.exe, 00000008.00000002.2554428927.0000000003128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrisepro
Source: file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2206916968.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2203998016.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207361950.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2209672095.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205935807.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204462762.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207840188.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2353080317.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205561890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2209349772.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204892541.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2343251890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2208459725.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2206158263.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204206244.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600149129.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604583006.0000000007A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2074032515.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2075009905.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072588247.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2258287784.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070998670.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2073084064.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2076462071.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2078211008.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2069734712.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2206916968.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2203998016.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207361950.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2209672095.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205935807.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204462762.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207840188.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2353080317.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205561890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2209349772.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204892541.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2343251890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RageMP131.exe, 0000001A.00000003.2600149129.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604583006.0000000007A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/O
Source: file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/n
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2206916968.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2203998016.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2348884384.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207361950.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2209672095.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205935807.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204462762.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207840188.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2353080317.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205561890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2209349772.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204892541.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2343251890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2208459725.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2206158263.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204206244.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600149129.0000000007A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RageMP131.exe, 00000011.00000002.2348884384.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/6)
Source: file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ata
Source: RageMP131.exe, 00000011.00000003.2206916968.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2203998016.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207361950.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2209672095.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205935807.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204462762.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207840188.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2353080317.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205561890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2209349772.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204892541.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2343251890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2208459725.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2206158263.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204206244.0000000007A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/efox/
Source: file.exe, 00000000.00000003.2074032515.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2075009905.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072588247.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2258287784.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070998670.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2073084064.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2076462071.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2078211008.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2069734712.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2206916968.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2203998016.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207361950.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2209672095.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205935807.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204462762.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207840188.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2353080317.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205561890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2209349772.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204892541.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2343251890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RageMP131.exe, 00000011.00000002.2353080317.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2343251890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/inata
Source: RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox
Source: file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/y.jaxxZs

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49751 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000011.00000002.2350759257.0000000004A1C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2256109726.0000000002F51000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000009.00000002.2555380044.0000000002FCE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001A.00000002.2603730581.0000000004A22000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.2554245395.0000000002F65000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00446020	0_2_00446020
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00428180	0_2_00428180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00496450	0_2_00496450
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406430	0_2_00406430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004224D9	0_2_004224D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C490	0_2_0040C490
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045A490	0_2_0045A490
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004564A0	0_2_004564A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048C560	0_2_0048C560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00458520	0_2_00458520
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00438770	0_2_00438770
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00424730	0_2_00424730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E7B0	0_2_0040E7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043C800	0_2_0043C800
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044A8F0	0_2_0044A8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00442940	0_2_00442940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042C980	0_2_0042C980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043CA90	0_2_0043CA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00434B20	0_2_00434B20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042EB90	0_2_0042EB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045CC40	0_2_0045CC40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00440C10	0_2_00440C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040CD50	0_2_0040CD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E925D	0_2_004E925D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048D250	0_2_0048D250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CB3C0	0_2_004CB3C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00431430	0_2_00431430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045B4B0	0_2_0045B4B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043B65D	0_2_0043B65D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00423670	0_2_00423670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042B670	0_2_0042B670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004176B0	0_2_004176B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043B750	0_2_0043B750
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004378A0	0_2_004378A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00431BE0	0_2_00431BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045DDE5	0_2_0045DDE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041FF09	0_2_0041FF09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BFC0	0_2_0040BFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048BFB0	0_2_0048BFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048E040	0_2_0048E040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044C160	0_2_0044C160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049A160	0_2_0049A160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00490100	0_2_00490100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D02E0	0_2_004D02E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004202AA	0_2_004202AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048E35B	0_2_0048E35B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00422360	0_2_00422360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D4310	0_2_004D4310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E03D0	0_2_004E03D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402410	0_2_00402410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004944E0	0_2_004944E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00416490	0_2_00416490
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402600	0_2_00402600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00484620	0_2_00484620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00422852	0_2_00422852
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00490860	0_2_00490860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043EAEB	0_2_0043EAEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D2A90	0_2_004D2A90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00486AA0	0_2_00486AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D0B30	0_2_004D0B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044EB90	0_2_0044EB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F6CC5	0_2_004F6CC5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048ECA2	0_2_0048ECA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048CD80	0_2_0048CD80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00490E40	0_2_00490E40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049EE70	0_2_0049EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049AE20	0_2_0049AE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414ED0	0_2_00414ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418EE0	0_2_00418EE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00482FE0	0_2_00482FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00440FF5	0_2_00440FF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048D020	0_2_0048D020
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CD080	0_2_004CD080
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040C490	8_2_0040C490
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004176B0	8_2_004176B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045DDE5	8_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040BFC0	8_2_0040BFC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00446020	8_2_00446020
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0044C160	8_2_0044C160
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0049A160	8_2_0049A160
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00490100	8_2_00490100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00428180	8_2_00428180
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004D02E0	8_2_004D02E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004202AA	8_2_004202AA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00422360	8_2_00422360
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004D4310	8_2_004D4310
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004E03D0	8_2_004E03D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00496450	8_2_00496450
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00402410	8_2_00402410
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00406430	8_2_00406430
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004224D9	8_2_004224D9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004944E0	8_2_004944E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00416490	8_2_00416490
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045A490	8_2_0045A490
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004564A0	8_2_004564A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048C560	8_2_0048C560
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00458520	8_2_00458520
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00402600	8_2_00402600
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00484620	8_2_00484620
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00438770	8_2_00438770
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00424730	8_2_00424730
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040E7B0	8_2_0040E7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00422852	8_2_00422852
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00490860	8_2_00490860
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043C800	8_2_0043C800
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0044A8F0	8_2_0044A8F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0042C980	8_2_0042C980
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043CA90	8_2_0043CA90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004D2A90	8_2_004D2A90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00486AA0	8_2_00486AA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00434B20	8_2_00434B20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004D0B30	8_2_004D0B30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0042EB90	8_2_0042EB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0044EB90	8_2_0044EB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045CC40	8_2_0045CC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00440C10	8_2_00440C10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004F6CC5	8_2_004F6CC5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040CD50	8_2_0040CD50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048CD80	8_2_0048CD80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00490E40	8_2_00490E40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0049EE70	8_2_0049EE70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0049AE20	8_2_0049AE20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00418EE0	8_2_00418EE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00482FE0	8_2_00482FE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00440FF5	8_2_00440FF5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048D020	8_2_0048D020
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004CD080	8_2_004CD080
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004E925D	8_2_004E925D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00487270	8_2_00487270
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048D35B	8_2_0048D35B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0047F360	8_2_0047F360
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004CB3C0	8_2_004CB3C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00483470	8_2_00483470
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00431430	8_2_00431430
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048B4F0	8_2_0048B4F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045B4B0	8_2_0045B4B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004E959F	8_2_004E959F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043B65D	8_2_0043B65D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00423670	8_2_00423670
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0042B670	8_2_0042B670
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004A36EE	8_2_004A36EE
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00433740	8_2_00433740
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043B750	8_2_0043B750
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00489720	8_2_00489720
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048F7B0	8_2_0048F7B0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004DD5B0 appears 40 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00402D00 appears 39 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0046A190 appears 94 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0048FE50 appears 51 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00469F00 appears 49 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 004DD5B0 appears 43 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0048FE50 appears 69 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 00469F00 appears 48 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 00402D00 appears 36 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0046A190 appears 91 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 784

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000003.1698876622.0000000004C20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewpa.dll( vs file.exe
Source: file.exe, 00000000.00000003.1742232486.0000000003093000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires0 vs file.exe
Source: file.exe, 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewpa.dll( vs file.exe
Source: file.exe, 00000000.00000000.1643190552.0000000002DBA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires0 vs file.exe
Source: file.exe, 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewpa.dll( vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameFires0 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000011.00000002.2350759257.0000000004A1C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2256109726.0000000002F51000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000009.00000002.2555380044.0000000002FCE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001A.00000002.2603730581.0000000004A22000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.2554245395.0000000002F65000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@25/125@3/3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00492300 GetLastError,GetVersionExA,FormatMessageW,LocalFree,FormatMessageA,

0_2_00492300

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00491D10 CreateFileW,CreateFileA,GetDiskFreeSpaceW,GetDiskFreeSpaceA,

0_2_00491D10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040CD50 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

0_2_0040CD50

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00446020 CopyFileA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,CopyFileA,GetUserNameA,CopyFileA,SHGetFolderPathA,CoInitialize,CoCreateInstance,MultiByteToWideChar,CoUninitialize,ShellExecuteA,

0_2_00446020

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7404:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7328
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7988

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, file.exe, 00000000.00000003.1698876622.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2345569703.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2552258510.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.2355371299.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2552333219.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000003.1698876622.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2345569703.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2552258510.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.2355371299.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2552333219.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.1935064684.0000000004C30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: RageMP131.exe, 00000011.00000003.2203998016.0000000007A73000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204462762.0000000007A73000.00000004.00000020.00020000.00000000.sdmp, rzThZlFR926oLogin Data.17.dr, jTDil21rwmscLogin Data For Account.0.dr, MKjdaszvj8XCLogin Data For Account.17.dr, SjNa0HpZUcV6Login Data For Account.26.dr, 2_TMjP6pWvYDLogin Data.0.dr, MGPDw7uupP6KLogin Data.26.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 784
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 960
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1008
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 996
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1020
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1416
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1828
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1848
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 820
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1808
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1940
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 940
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1948
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 952
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dpapi.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\kiyecatuvoxule\xawip-har\kizipinayuzeh.pdb source: file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr
Source:	Binary string: (C:\kiyecatuvoxule\xawip-har\kizipinayuzeh.pdb source: file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 17.2.RageMP131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 26.2.RageMP131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 17.2.RageMP131.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 26.2.RageMP131.exe.400000.0.unpack

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0045DDE5 LoadLibraryA,GetProcAddress,MessageBoxA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetProcessId,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetThreadExecutionState,SetThreadExecutionState,SetThreadExecutionState,

0_2_0045DDE5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C112B push ecx; iretd	0_2_004C112C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DD189 push ecx; ret	0_2_004DD19C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004C112B push ecx; iretd	8_2_004C112C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DD189 push ecx; ret	8_2_004DD19C

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00482FE0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00482FE0

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Country aware sample found (crashes after keyboard check)

Source: c:\users\user\desktop\file.exe

Event Logs and Signature results: Application crash and keyboard check

Found API chain indicative of sandbox detection

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Sandbox detection routine: GetCursorPos, DecisionNode, Sleep
Source: C:\Users\user\Desktop\file.exe	Sandbox detection routine: GetCursorPos, DecisionNode, Sleep			graph_0-70965

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_0-65998
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_0-70961

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\file.exe	Stalling execution: Execution stalls by calling Sleep			graph_0-65942
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Stalling execution: Execution stalls by calling Sleep

Source: C:\Users\user\Desktop\file.exe	Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,		0_2_0045D9F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,		8_2_0045D9F0

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Source: C:\Users\user\Desktop\file.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-65942

Source: C:\Users\user\Desktop\file.exe TID: 7332	Thread sleep count: 76 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7332	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7332	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7588	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7596	Thread sleep count: 98 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7992	Thread sleep count: 89 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7992	Thread sleep count: 128 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1516	Thread sleep count: 78 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1516	Thread sleep count: 43 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1516	Thread sleep count: 98 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00464270 GetKeyboardLayoutList followed by cmp: cmp esi, edi and CTI: je 00464293h	0_2_00464270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004624B0 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 004624C0h country: Upper Sorbian (hsb)	0_2_004624B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00464270 GetKeyboardLayoutList followed by cmp: cmp esi, edi and CTI: je 00464293h	8_2_00464270
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004624B0 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 004624C0h country: Upper Sorbian (hsb)	8_2_004624B0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00492190 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 004921D1h		0_2_00492190
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00492190 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 004921D1h		8_2_00492190

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E7B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	0_2_0040E7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DB1CB FindClose,FindFirstFileExW,GetLastError,	0_2_004DB1CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040B300 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_0040B300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041FA10 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_0041FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043EAEB FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CopyFileA,CopyFileA,	0_2_0043EAEB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040E7B0 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	8_2_0040E7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043CA90 CreateThread,CredEnumerateA,SHGetFolderPathA,CreateThread,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CopyFileA,CopyFileA,	8_2_0043CA90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DB1CB FindClose,FindFirstFileExW,GetLastError,	8_2_004DB1CB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DB251 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	8_2_004DB251
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040B300 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	8_2_0040B300

Source: C:\Users\user\Desktop\file.exe

0_2_0040CD50

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: RageMP131.exe, 00000011.00000003.2008536036.0000000002FE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}C
Source: file.exe, 00000000.00000002.2256177341.00000000030A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnk
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.000000000307B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030E9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RageMP131.exe, 0000001A.00000003.2093321378.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: RageMP131.exe, 00000011.00000002.2348884384.0000000002F70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: MPGPH131.exe, 00000008.00000003.2368810046.00000000030D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}X(
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: MPGPH131.exe, 00000009.00000003.2387852289.0000000002E56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}4w
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MPGPH131.exe, 00000008.00000002.2554428927.00000000030E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: file.exe, 00000000.00000002.2258431224.0000000007A89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_926F18F8sautoD
Source: RageMP131.exe, 0000001A.00000002.2603079344.0000000002F95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: RageMP131.exe, 00000011.00000002.2348884384.0000000002FDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 00000011.00000002.2353136507.0000000007A92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_926F18F8y
Source: RageMP131.exe, 00000011.00000002.2348884384.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RageMP131.exe, 0000001A.00000002.2603079344.0000000002F40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&'
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MPGPH131.exe, 00000009.00000002.2554347578.0000000002E40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MPGPH131.exe, 00000009.00000002.2554347578.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW5t
Source: Amcache.hve.7.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: MPGPH131.exe, 00000008.00000002.2554428927.0000000003060000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&z)
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: RageMP131.exe, 0000001A.00000002.2604583006.0000000007A92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_926F18F8
Source: file.exe, 00000000.00000003.2223197438.0000000007AA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}J6HEdjEHUub5EtqTQ2dk3wwrCNfruTWZeEqONRrqgXAW0ke6pZXg==_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=*

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00414870 IsDebuggerPresent,

0_2_00414870

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0045E5D4 CreateThread,CloseHandle,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,OutputDebugStringA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

0_2_0045E5D4

Source: C:\Users\user\Desktop\file.exe

0_2_0045DDE5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004160B0 mov ecx, dword ptr fs:[00000030h]	0_2_004160B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045E5D4 mov eax, dword ptr fs:[00000030h]	0_2_0045E5D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045E5D4 mov ecx, dword ptr fs:[00000030h]	0_2_0045E5D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043CA90 mov eax, dword ptr fs:[00000030h]	0_2_0043CA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041AB90 mov eax, dword ptr fs:[00000030h]	0_2_0041AB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	0_2_0045D9F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	0_2_0045D9F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	0_2_0045DDE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	0_2_0045DDE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	0_2_0045DDE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	0_2_0045DDE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041AB90 mov eax, dword ptr fs:[00000030h]	0_2_0041AB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041AB90 mov eax, dword ptr fs:[00000030h]	0_2_0041AB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414870 mov eax, dword ptr fs:[00000030h]	0_2_00414870
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414ED0 mov eax, dword ptr fs:[00000030h]	0_2_00414ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414ED0 mov eax, dword ptr fs:[00000030h]	0_2_00414ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414ED0 mov eax, dword ptr fs:[00000030h]	0_2_00414ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414ED0 mov eax, dword ptr fs:[00000030h]	0_2_00414ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414ED0 mov eax, dword ptr fs:[00000030h]	0_2_00414ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414ED0 mov eax, dword ptr fs:[00000030h]	0_2_00414ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414ED0 mov eax, dword ptr fs:[00000030h]	0_2_00414ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414ED0 mov eax, dword ptr fs:[00000030h]	0_2_00414ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414ED0 mov eax, dword ptr fs:[00000030h]	0_2_00414ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414ED0 mov eax, dword ptr fs:[00000030h]	0_2_00414ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414ED0 mov eax, dword ptr fs:[00000030h]	0_2_00414ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414ED0 mov eax, dword ptr fs:[00000030h]	0_2_00414ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041AB90 mov eax, dword ptr fs:[00000030h]	0_2_0041AB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041EF10 mov eax, dword ptr fs:[00000030h]	0_2_0041EF10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045E5D4 mov eax, dword ptr fs:[00000030h]	8_2_0045E5D4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045E5D4 mov ecx, dword ptr fs:[00000030h]	8_2_0045E5D4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041AB90 mov eax, dword ptr fs:[00000030h]	8_2_0041AB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	8_2_0045D9F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	8_2_0045D9F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	8_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	8_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	8_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	8_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041AB90 mov eax, dword ptr fs:[00000030h]	8_2_0041AB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004160B0 mov ecx, dword ptr fs:[00000030h]	8_2_004160B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041AB90 mov eax, dword ptr fs:[00000030h]	8_2_0041AB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414870 mov eax, dword ptr fs:[00000030h]	8_2_00414870
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043CA90 mov eax, dword ptr fs:[00000030h]	8_2_0043CA90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041AB90 mov eax, dword ptr fs:[00000030h]	8_2_0041AB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041EF10 mov eax, dword ptr fs:[00000030h]	8_2_0041EF10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00482C80 GetProcessHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00482C80

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DD3B4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		8_2_004DD3B4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DD74D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		8_2_004DD74D

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418BB0 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		0_2_00418BB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00418BB0 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		8_2_00418BB0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004149F0 cpuid

0_2_004149F0

Source: C:\Users\user\Desktop\file.exe	Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_0040CD50
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_004FC045
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_004FC090
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_004FC12B
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_004FC1B6
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_004F43EA
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_004FC409
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004FC532
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_004FC638
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004FC70E
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_004F496D
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_004DAFC3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	8_2_004FC045
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	8_2_004FC090
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	8_2_004FC12B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_004FC1B6
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	8_2_004F43EA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	8_2_004FC409
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_004FC532
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	8_2_004FC638
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_004FC70E
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	8_2_004F496D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	8_2_0040CD50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoEx,FormatMessageA,	8_2_004DAFC3

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

0_2_0040CD50

Source: C:\Users\user\Desktop\file.exe

0_2_00446020

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F636F GetTimeZoneInformation,

0_2_004F636F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00491C30 GetVersionExA,CreateFileW,

0_2_00491C30

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 8.3.MPGPH131.exe.4a60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4ac0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.RageMP131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MPGPH131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.MPGPH131.exe.4a10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.RageMP131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.RageMP131.exe.4c40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MPGPH131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.48b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.RageMP131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.RageMP131.exe.4ad0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.RageMP131.exe.4ae0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.RageMP131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MPGPH131.exe.4900e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.4c20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.RageMP131.exe.4c30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000003.2307637364.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2253726342.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2258287784.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2603079344.0000000002F47000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2345569703.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2256177341.000000000302E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1698876622.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2352946266.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1935064684.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2604404588.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2348884384.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2345301493.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2355371299.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2552333219.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2601441093.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2552258510.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2050121383.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 2352, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\dSyaNbAby9QXs4RBu3VN33H.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\e_uwnYJDOrnylP4tGD1vKSo.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\OfCx6VeglYVpWTwI9NddWAo.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2222334467.0000000007A9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\walletsH
Source: file.exe, 00000000.00000003.2222334467.0000000007A9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\com.liberty.jaxx
Source: file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.walletE>
Source: RageMP131.exe, 00000011.00000003.2305959394.0000000003058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets=]
Source: file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.walletE>
Source: file.exe, 00000000.00000003.2222334467.0000000007A9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: RageMP131.exe, 00000011.00000003.2305959394.0000000003058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets=]
Source: file.exe, 00000000.00000003.2222334467.0000000007A9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets*
Source: file.exe, 00000000.00000003.2222334467.0000000007A9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: RageMP131.exe, 00000011.00000003.2305959394.0000000003058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\GN
Source: file.exe, 00000000.00000002.2256177341.000000000307B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 00000011.00000003.2305959394.0000000003058000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2343081719.0000000003065000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2350560658.0000000003069000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2307237063.0000000003058000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 2352, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 8.3.MPGPH131.exe.4a60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4ac0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.RageMP131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MPGPH131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.MPGPH131.exe.4a10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.RageMP131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.RageMP131.exe.4c40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MPGPH131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.48b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.RageMP131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.RageMP131.exe.4ad0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.RageMP131.exe.4ae0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.RageMP131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MPGPH131.exe.4900e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.4c20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.RageMP131.exe.4c30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000003.2307637364.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2253726342.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2258287784.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2603079344.0000000002F47000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2345569703.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2256177341.000000000302E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1698876622.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2352946266.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1935064684.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2604404588.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2348884384.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2345301493.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2355371299.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2552333219.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2601441093.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2552258510.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2050121383.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 2352, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\dSyaNbAby9QXs4RBu3VN33H.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\e_uwnYJDOrnylP4tGD1vKSo.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\OfCx6VeglYVpWTwI9NddWAo.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	57 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	261 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Virtualization/Sandbox Evasion	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs
file.exe	100%	Avira	HEUR/AGEN.1310450
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	HEUR/AGEN.1310450
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	47%	ReversingLabs
C:\ProgramData\MPGPH131\MPGPH131.exe	48%	Virustotal		Browse
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	47%	ReversingLabs
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	48%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.233.132.167/cost/lenin.exe	100%	URL Reputation	malware
http://147.45.47.102:57893/hera/amadka.exe	15%	Virustotal		Browse
http://193.233.132.167/cost/go.exe	25%	Virustotal		Browse
http://193.233.132.167/cost/go.exee	24%	Virustotal		Browse
http://193.233.132.167/cost/lenin.exe192.168.0	25%	Virustotal		Browse
http://193.233.132.167/cost/go.exero	24%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		high
db-ip.com	104.26.4.15	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/81.181.57.52	false		high
https://db-ip.com/demo/home.php?s=81.181.57.52	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	D87fZN3R3jFeplaces.sqlite.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	false		high
https://db-ip.com/demo/home.php?s=81.181.57.52j	MPGPH131.exe, 00000008.00000002.2554428927.0000000003128000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe	RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse	unknown
https://ipinfo.io/widget/demo/81.181.57.52$v	MPGPH131.exe, 00000009.00000002.2554347578.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.mtO	MPGPH131.exe, 00000009.00000002.2554347578.0000000002EAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://db-ip.com/	MPGPH131.exe, 00000008.00000002.2554428927.0000000003128000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002EAC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/lenin.exese	file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	false		high
https://t.me/risepro_botW	file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	RageMP131.exe, 00000011.00000003.2207015077.0000000007ABD000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2465348973.0000000007AB3000.00000004.00000020.00020000.00000000.sdmp, LZlzsFoefEVpHistory.17.dr, d4QTaPGdbj7gHistory.17.dr, MBSHfyCuKHxNHistory.26.dr, IcPAi7xok6iaHistory.0.dr, QkoBCD2tTFlpHistory.0.dr, GUahzsMvIC8wHistory.26.dr	false		high
http://147.45.47.102:57893/hera/amadka.exeDatae	RageMP131.exe, 00000011.00000002.2353080317.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2343251890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.47.102:57893/hera/amadka.exe.52	RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://db-ip.com:443/demo/home.php?s=81.181.57.52D)	MPGPH131.exe, 00000008.00000002.2554428927.00000000030E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/81.181.57.52H)	MPGPH131.exe, 00000008.00000002.2554428927.00000000030E9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exe	file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600149129.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604583006.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse	unknown
http://147.45.47.102:57893/hera/amadka.exedatD	RageMP131.exe, 0000001A.00000003.2600149129.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604583006.0000000007A92000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://db-ip.com/demo/home.php?s=81.181.57.52gQ	RageMP131.exe, 00000011.00000002.2348884384.0000000002FDC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/?	MPGPH131.exe, 00000008.00000002.2554428927.0000000003128000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/~	RageMP131.exe, 0000001A.00000002.2603079344.0000000002FA2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTR	RageMP131.exe, 00000011.00000002.2352946266.0000000007A40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io:443/widget/demo/81.181.57.52	file.exe, 00000000.00000002.2256177341.00000000030A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030E9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2306068480.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307548661.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349881372.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2312025857.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2308251432.0000000002FF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	LZlzsFoefEVpHistory.17.dr, d4QTaPGdbj7gHistory.17.dr, MBSHfyCuKHxNHistory.26.dr, IcPAi7xok6iaHistory.0.dr, QkoBCD2tTFlpHistory.0.dr, GUahzsMvIC8wHistory.26.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	false		high
https://ipinfo.io/t	file.exe, 00000000.00000002.2256177341.000000000307B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botisepro_bot	RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exee	RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse	unknown
http://193.233.132.167/cost/lenin.exepro_botF	RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.167/cost/lenin.exe	file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2353080317.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2343251890.0000000007A88000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600149129.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604583006.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://ipinfo.io/n	MPGPH131.exe, 00000009.00000002.2554347578.0000000002E30000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botrisepro	MPGPH131.exe, 00000008.00000002.2554428927.0000000003128000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com:443/demo/home.php?s=81.181.57.52r	file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot.	file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=81.181.57.525w	MPGPH131.exe, 00000009.00000002.2554347578.0000000002EAC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com:443/demo/home.php?s=81.181.57.52	MPGPH131.exe, 00000009.00000002.2554347578.0000000002EAC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000003002000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exeoinxs	file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io/widget/demo/81.181.57.52.tmpW	MPGPH131.exe, 00000008.00000002.2554428927.00000000030AA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	false		high
https://t.me/RiseProSUPPORTS)	MPGPH131.exe, 00000008.00000002.2554428927.000000000306E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/lenin.exe192.168.0	RageMP131.exe, 0000001A.00000003.2600250501.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	file.exe, 00000000.00000003.1698876622.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2345569703.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2552258510.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.2355371299.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2552333219.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.1935064684.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2345301493.0000000000400000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000001A.00000002.2601441093.0000000000400000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000001A.00000003.2050121383.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	false		high
http://upx.sf.net	Amcache.hve.7.dr	false		high
https://t.me/RiseProSUPPORT	RageMP131.exe, 0000001A.00000002.2604404588.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, dSyaNbAby9QXs4RBu3VN33H.zip.17.dr, e_uwnYJDOrnylP4tGD1vKSo.zip.0.dr, OfCx6VeglYVpWTwI9NddWAo.zip.26.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	RageMP131.exe, 00000011.00000003.2207015077.0000000007ABD000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2465348973.0000000007AB3000.00000004.00000020.00020000.00000000.sdmp, LZlzsFoefEVpHistory.17.dr, d4QTaPGdbj7gHistory.17.dr, MBSHfyCuKHxNHistory.26.dr, IcPAi7xok6iaHistory.0.dr, QkoBCD2tTFlpHistory.0.dr, GUahzsMvIC8wHistory.26.dr	false		high
https://t.me/RiseProSUPPORT$	RageMP131.exe, 00000011.00000003.2307637364.0000000007A99000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.G	MPGPH131.exe, 00000009.00000002.2554347578.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	false		high
https://ipinfo.io/Mozilla/5.0	file.exe, 00000000.00000002.2256177341.00000000030A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072010146.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030E9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2349974931.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2307237063.0000000002FFD000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2305959394.0000000002FFD000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603079344.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2600250501.0000000002FBB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.0.dr	false		high
https://t.me/risepro_bot1.181.57.52	MPGPH131.exe, 00000009.00000002.2554347578.0000000002EAC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	false		high
https://t.me/risepro_bot	RageMP131.exe, 0000001A.00000002.2603079344.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2568774506.0000000007AFA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604404588.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr, passwords.txt.26.dr, passwords.txt.17.dr	false		high
http://193.233.132.167/cost/lenin.exe~	RageMP131.exe, 0000001A.00000003.2600149129.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604583006.0000000007A92000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.167/cost/go.exero	RageMP131.exe, 0000001A.00000003.2600149129.0000000007A92000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2604583006.0000000007A92000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse	unknown
https://t.me/risepro_botlater	file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/	file.exe, file.exe, 00000000.00000002.2256177341.000000000305D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072010146.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.00000000030A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072010146.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2256177341.000000000307B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2068786897.00000000030B2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2023096366.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000008.00000002.2554428927.00000000030E9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030CF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.00000000030A0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2554428927.0000000003128000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002E30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2554347578.0000000002EAC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2348884384.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.maxmind.com/en/locate-my-ip-address	file.exe, MPGPH131.exe	false		high
http://www.winimage.com/zLibDll	file.exe, file.exe, 00000000.00000003.1698876622.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2345569703.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2552258510.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.2355371299.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2552333219.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.1935064684.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2345301493.0000000000400000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000001A.00000002.2601441093.0000000000400000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000001A.00000003.2050121383.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp	false		high
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	LZlzsFoefEVpHistory.17.dr, d4QTaPGdbj7gHistory.17.dr, MBSHfyCuKHxNHistory.26.dr, IcPAi7xok6iaHistory.0.dr, QkoBCD2tTFlpHistory.0.dr, GUahzsMvIC8wHistory.26.dr	false		high
http://147.45.47.102:57893/hera/amadka.exe_prof	file.exe, 00000000.00000002.2258233237.0000000007A40000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2069670213.0000000007A97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2072850690.0000000007AC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2070675750.0000000007AB6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2204823122.0000000007AA1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2205392926.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.2207595025.0000000007ACE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2463165278.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2462740121.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2466057502.0000000007AD5000.00000004.00000020.00020000.00000000.sdmp, Tx9lIpMUG2zOWeb Data.26.dr, weyqQCNm9HN2Web Data.0.dr, tcNWocR92MUuWeb Data.17.dr, ToLgTrDbYUcjWeb Data.26.dr, FxAu1a1JDtB8Web Data.0.dr, eBt1v4cLiOqEWeb Data.0.dr, fotzzxFskzb6Web Data.17.dr, 8Mse1jO6nK1IWeb Data.26.dr, 6_PbUyeA3kVjWeb Data.17.dr	false		high
http://www.winimage.com/zLibDllDpRTpR	file.exe, 00000000.00000003.1698876622.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2345569703.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2552258510.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.2355371299.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2552333219.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000003.1935064684.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.2345301493.0000000000400000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000001A.00000002.2601441093.0000000000400000.00000040.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000001A.00000003.2050121383.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
104.26.4.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427905
Start date and time:	2024-04-18 10:28:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@25/125@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 81 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:29:03	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
09:29:03	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
09:29:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
09:29:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
147.45.47.93	dendy.exe	Get hash	malicious	RisePro Stealer	Browse
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	7AdIyN5s2K.exe	Get hash	malicious	RisePro Stealer	Browse
	YUoiqJo8Sk.exe	Get hash	malicious	RisePro Stealer	Browse
	JR58WqLhRl.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	I44O512o10.exe	Get hash	malicious	RisePro Stealer	Browse
	Jt0SXpowC4.exe	Get hash	malicious	RisePro Stealer	Browse
104.26.4.15	#Ud3ec#Ud2b8#Ud3f4#Ub9ac#Uc624.exe	Get hash	malicious	Nemty, Xmrig	Browse	api.db-ip.com/v2/free/102.129.152.212/countryName

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	EpsilonFruit.exe	Get hash	malicious	Pafish	Browse	34.117.186.192
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	BetaUnfrated.exe	Get hash	malicious	Pafish	Browse	34.117.186.192
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	SecuriteInfo.com.FileRepMalware.18165.2747.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
db-ip.com	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	172.67.75.166
	7AdIyN5s2K.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15
	YUoiqJo8Sk.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	JR58WqLhRl.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	TANQUIVUIA.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	172.67.75.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	34.117.186.192
	EpsilonFruit.exe	Get hash	malicious	Pafish	Browse	34.117.186.192
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	http://www.indeks.pt/	Get hash	malicious	Unknown	Browse	34.117.198.124
	BetaUnfrated.exe	Get hash	malicious	Pafish	Browse	34.117.186.192
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
FREE-NET-ASFREEnetEU	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	193.233.132.175
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	https://casestudybuddy.com	Get hash	malicious	Unknown	Browse	147.45.47.87
	PBZcC2ge1z.exe	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	147.45.77.238
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	7AdIyN5s2K.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	YUoiqJo8Sk.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
CLOUDFLARENETUS	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	5Dw2hTQmiB.exe	Get hash	malicious	LummaC	Browse	104.21.44.10
	Purchase Order PDF.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	104.21.44.10
	Leoch-Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	p silp AI240190.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://ortelia.com/Downloads/Curator/CuratorSetup.exe	Get hash	malicious	Havoc	Browse	1.1.1.1
	https://app.esign.docusign.com/e/er?utm_campaign=GBL_XX_DBU_NEW_2307_FreetoTrialUnlock_Email1AU&utm_medium=email&utm_source=Eloqua&elqCampaignId=29542&s=566810826&lid=32871&elqTrackId=1034fb987fd44c9a9a4d0833ff06a55d&elq=89d72859fe264966a0176d4309dbb1a6&elqaid=60251&elqat=1	Get hash	malicious	Unknown	Browse	172.64.151.101
	https://ortelia.com/download-ortelia-curator/	Get hash	malicious	Havoc	Browse	1.1.1.1
	SecuriteInfo.com.Win32.PWSX-gen.1728.1300.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	5Dw2hTQmiB.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	Quotation 20241804.exe	Get hash	malicious	Remcos, DBatLoader	Browse	34.117.186.192 104.26.4.15
	file.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	ORDER-CONFIRMATION-DETAILS-000235374564.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	34.117.186.192 104.26.4.15
	file.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	payload.js	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	payload.js	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	file.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	SecuriteInfo.com.Win32.RATX-gen.12024.12837.exe	Get hash	malicious	Remcos, DBatLoader	Browse	34.117.186.192 104.26.4.15

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	962560
Entropy (8bit):	7.713192136777905
Encrypted:	false
SSDEEP:	12288:oekLV5eBOkw6Qhe4Yh5wV/uVJuEk6sP4lX8DbDK45dg/bdlh84LZ8Xt8quJsHmrE:on6rhau/OglUbD5yb5LLuXBuJsH4
MD5:	265D5B8B9F603F0F5EF62F2C27449607
SHA1:	39576D6D8388DEA489946141DBCCF9CF5FE3A28F
SHA-256:	948D096A3931A22F116B93FFEEFB3A374834D8EB578620C0FFC83F3E468EED81
SHA-512:	9D4AC79A62FBD0CB1D76C48848AF7863DDA72BD16368250A2258B3D30A4DDDCB24C38AC62555222706041A5073CBC39D291B14ECDF222C7E04ADD5374403AF66
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47% Antivirus: Virustotal, Detection: 48%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....0.e............................g............@.................................:........................................(..d.......p........................... ...8...................h....... ...@............................................text.............................. ..`.rdata.............................@..@.data....Q...@.......&..............@....rsrc...p...........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_3b166e6571299cee7343626b59f7d7bbe157b8c9_45086259_c58001ed-2ce3-4e1e-9019-867a112921c2\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9086736091529007
Encrypted:	false
SSDEEP:	96:qlqXTP2/syhqjoA7JfPQXIDcQnc6rCcEhcw3rL+HbHg/8BRTf3ZFEOyKZoxm9nFc:nP2/qk056rgjpSZrYFzuiFAZ24IO8Wf
MD5:	44DCD5695C3596C86950762358FC312B
SHA1:	FA67FBE5F2E8A8DBDF48B2EDE6FF8949108D7ECC
SHA-256:	AC095DBAF59A398776CC78FB8AF73BEEB95880CD4AA4D6391B922BF323CB8364
SHA-512:	A34C93CDEF10726F3E35A4C425A96D90413261B286A92F4B3441E3FF9B7E3FD466E417C80E594B8AB048C916DACBEFE4E55A1639F3B6EEA0022122351B598BC2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.6.8.8.8.1.8.5.3.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.5.8.0.0.1.e.d.-.2.c.e.3.-.4.e.1.e.-.9.0.1.9.-.8.6.7.a.1.1.2.9.2.1.c.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.c.f.c.1.a.3.d.-.8.7.4.8.-.4.4.e.f.-.9.6.3.2.-.f.c.8.3.a.7.3.e.b.b.a.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.a.g.e.M.P.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.3.4.-.0.0.0.1.-.0.0.1.4.-.d.1.a.0.-.4.3.7.f.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.4.c.8.a.f.e.7.0.8.2.7.c.2.d.4.6.a.b.3.3.2.9.a.1.2.c.5.5.3.b.5.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.R.a.g.e.M.P.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.R.a.g.e.M.P.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_3b166e6571299cee7343626b59f7d7bbe157b8c9_45086259_ccde6796-0630-43ad-93e5-81a73d475583\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9487723351229108
Encrypted:	false
SSDEEP:	192:vSPc/qk056rgjpSZrYKzuiFAZ24IO8Wf:qPsqf56rgjYzuiFAY4IO8Wf
MD5:	D2F49D5142CF7B9199E4B1291F3D8465
SHA1:	481949304E1B8C26ED92D5B0C089FD8D25A42DB2
SHA-256:	3C1CB55CFD5B02DDB4FF3DB3D4493F45B21F20A80D5611FAE406C0A621EAE79E
SHA-512:	FD41397F17B02B4FB40850F0C22CFE54287E477B6FF65FEFFF7F68E9307CA8C3A0929058EFECBC6A867AA0955127328528A14DD1945C2BF5C4B9317AD4043696
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.7.5.2.4.1.9.8.1.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.c.d.e.6.7.9.6.-.0.6.3.0.-.4.3.a.d.-.9.3.e.5.-.8.1.a.7.3.d.4.7.5.5.8.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.0.2.0.8.9.7.7.-.2.7.8.d.-.4.a.5.a.-.8.e.d.6.-.c.2.6.8.4.9.1.e.6.7.2.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.a.g.e.M.P.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.3.4.-.0.0.0.1.-.0.0.1.4.-.d.1.a.0.-.4.3.7.f.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.4.c.8.a.f.e.7.0.8.2.7.c.2.d.4.6.a.b.3.3.2.9.a.1.2.c.5.5.3.b.5.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.R.a.g.e.M.P.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.R.a.g.e.M.P.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_3b166e6571299cee7343626b59f7d7bbe157b8c9_45086259_dfa15fe3-4273-4d5b-97f7-438a6adc3f79\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9485051067992631
Encrypted:	false
SSDEEP:	192:eyRPe/qk056rgjpSZrYKzuiFAZ24IO8Wf:eyRP+qf56rgjYzuiFAY4IO8Wf
MD5:	8F29F23BFCE648A84B7248B90F70A13E
SHA1:	B7F4521DA7855D3BB81A48259F93573A1CE98331
SHA-256:	85FCC6B4802C20BA0B03B2ADAD935850FFB2774DA36C211E3ABB2AC7E686B434
SHA-512:	8EC842B1C1000048EC5EAB9F32CE2A76ADA1EC0A67FDD3D3EDA132DB006534D750E39CDAE58B1F1D15161E8E9245D7279C3E021360DB23D78A5DE1F0FAA30C62
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.7.6.9.7.9.6.5.8.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.f.a.1.5.f.e.3.-.4.2.7.3.-.4.d.5.b.-.9.7.f.7.-.4.3.8.a.6.a.d.c.3.f.7.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.a.3.a.1.b.1.-.b.3.d.d.-.4.4.9.2.-.8.1.7.9.-.d.8.e.5.2.1.f.e.2.1.e.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.a.g.e.M.P.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.3.4.-.0.0.0.1.-.0.0.1.4.-.d.1.a.0.-.4.3.7.f.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.4.c.8.a.f.e.7.0.8.2.7.c.2.d.4.6.a.b.3.3.2.9.a.1.2.c.5.5.3.b.5.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.R.a.g.e.M.P.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.R.a.g.e.M.P.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4594c263b2b2fddaf2855c7efb1b922584ccf4c_804fa867_cf5d468c-292b-40ba-84bc-75df7a1336d9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0360082152974495
Encrypted:	false
SSDEEP:	192:IgBL3BxvBPl00JsAnbcAgI3jpSZrYTnkzuiFAZ24IO8TVB:Ik7vBNvJsAnbcA3j5kzuiFAY4IO8X
MD5:	F0BF6CDECE47724B174B8D0CA96E4047
SHA1:	6DE159AAE508F3B140509D664561DEEA4EF05EDA
SHA-256:	AEB13CBDE7EC76A1D9F6238666C45B2D5FDCF61147F69333FB2F5A3BD1F00DB4
SHA-512:	1A0AABA4ED7F377B5EB220FA036477D31ACAC05CFCF00648267C7B61F96CED945A61ABB6439C630BA6EB3E84592B5C894190465D2F2F7B83068EFB33FE88134D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.7.3.4.4.5.7.2.3.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.f.5.d.4.6.8.c.-.2.9.2.b.-.4.0.b.a.-.8.4.b.c.-.7.5.d.f.7.a.1.3.3.6.d.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.8.5.0.2.7.c.1.-.b.f.8.b.-.4.2.4.3.-.8.2.5.4.-.e.f.5.5.9.f.6.6.a.2.9.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.0.-.0.0.0.1.-.0.0.1.4.-.3.e.d.0.-.f.3.7.2.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4594c263b2b2fddaf2855c7efb1b922584ccf4c_804fa867_fb3b76dc-3723-4c12-95a8-3eb742cb3382\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0362499842329518
Encrypted:	false
SSDEEP:	192:iBL3Bxv7Pl00JsAnbcAgI3jpSZrYTnkzuiFAZ24IO8TVB:i7v7NvJsAnbcA3j5kzuiFAY4IO8X
MD5:	118065AC260CABBAF906DBC130191207
SHA1:	B6392C689B1E9CF1EDDB79C476FEF90144AEBB3F
SHA-256:	C16716A5CD105E477848B2BCABC9F10F972C3C651FE56D7B095DB526ED06C1DB
SHA-512:	12B7FF3241421B62A25DD84384B0D56FB407C3C98A80AE47BA7AA3323C9A17AE627F1F5BDA9023552F84B24B2F081EA10F97A0FEB3A2B5211C3D8E155B7A0D39
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.7.5.9.7.8.4.2.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.b.3.b.7.6.d.c.-.3.7.2.3.-.4.c.1.2.-.9.5.a.8.-.3.e.b.7.4.2.c.b.3.3.8.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.8.4.9.8.a.4.0.-.b.1.c.f.-.4.c.3.0.-.a.d.0.c.-.b.6.6.9.3.c.0.d.a.9.5.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.0.-.0.0.0.1.-.0.0.1.4.-.3.e.d.0.-.f.3.7.2.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_1bea40c6-29f2-46a6-b131-6f75278ec17c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0163392293919353
Encrypted:	false
SSDEEP:	192:SPTBL3BxvWPlk056rPI3jpSZrYTjzuiFAZ24IO8TVB:S17vWNf56rIj9zuiFAY4IO8X
MD5:	91D78F42A37111030F82DB3F26A3C02F
SHA1:	FD14272B4F0076F3FD98815073008FBEFE01238B
SHA-256:	5116FAA201D2780AEC2953E0CD63DAC1AF62016C38C51699F478E9496D825E54
SHA-512:	8BDF6A4096A0704FA28970D95AE67A51F2204C168DDBBCA197DE3C3CD45C45075BAAD689DC970712BB6781E36E9BF7558AF10AE047344795282DF2743F2BCFCA
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.6.1.9.1.4.1.9.8.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.e.a.4.0.c.6.-.2.9.f.2.-.4.6.a.6.-.b.1.3.1.-.6.f.7.5.2.7.8.e.c.1.7.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.7.0.6.e.5.a.f.-.5.c.3.e.-.4.3.c.5.-.b.3.4.c.-.7.a.8.b.3.c.3.5.7.d.7.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.0.-.0.0.0.1.-.0.0.1.4.-.3.e.d.0.-.f.3.7.2.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_7468fa83-67cd-459b-9cbc-4c12e81c893a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.029632107834421
Encrypted:	false
SSDEEP:	192:4Ke1BL3BxvPPlk056rPI3jpSZrYTndzuiFAZ24IO8TVB:rS7vPNf56rIj5dzuiFAY4IO8X
MD5:	BFBF249A7BC61449944E80951DD051D6
SHA1:	31EC8F4480B0163C94766C0B630FAE82CFC57005
SHA-256:	D5A22F7BA2AD2D458D6072E4D59884741803B61E772661545929982323460D52
SHA-512:	8EDC70537FE9CDE810D2A00917D83007D79CCF01406B9A4A140D2287FB78C5D57259FFF0152E251863E2852D43627B50C540DB1E7645C276A4FAD0C4BB507DE9
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.7.0.0.8.6.6.6.4.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.4.6.8.f.a.8.3.-.6.7.c.d.-.4.5.9.b.-.9.c.b.c.-.4.c.1.2.e.8.1.c.8.9.3.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.8.2.7.9.e.3.3.-.e.f.3.9.-.4.3.7.c.-.8.d.e.b.-.0.3.4.c.3.2.9.1.2.f.4.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.0.-.0.0.0.1.-.0.0.1.4.-.3.e.d.0.-.f.3.7.2.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_8b113e4e-2225-4b05-80d3-ff5f486a2ef9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9426141417534122
Encrypted:	false
SSDEEP:	192:DLBL3BxvJPlk056rPI3jpSZrYKzuiFRZ24IO8TVB:R7vJNf56rIj4zuiFRY4IO8X
MD5:	64255BF364F99EE1B70AFB188DFEFD50
SHA1:	FF26F954D1E5D73EA04283145ADEA48A1C065FAC
SHA-256:	BC284E63AA7ACBAB801227BFE1C7AF7FF02FE3D9869104482904572D6707F34C
SHA-512:	EBCD129E695130C5D59780F5640FB5C130CFDF1AE2233CB5F76F3837C4BA8C30D17CAF577DBED703E381A0350B345923E0943EBAC402C8DDD0FE5936FCEC0527
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.5.4.4.0.2.5.1.5.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.1.1.3.e.4.e.-.2.2.2.5.-.4.b.0.5.-.8.0.d.3.-.f.f.5.f.4.8.6.a.2.e.f.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.f.4.a.9.7.6.-.4.4.6.3.-.4.9.9.8.-.a.9.b.a.-.5.a.5.9.a.3.8.8.2.e.d.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.0.-.0.0.0.1.-.0.0.1.4.-.3.e.d.0.-.f.3.7.2.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_aa9cc303-3ec6-47f1-8d50-17d31237829f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9424061754882452
Encrypted:	false
SSDEEP:	192:LBL3BxvgPlk056rPI3jpSZrYKzuiFRZ24IO8TVB:17vgNf56rIj4zuiFRY4IO8X
MD5:	F419CA7CFB1ED7979B500B2BE8695FB6
SHA1:	55EB8474EB34C92D0D900B57B9B3CB2A828EB746
SHA-256:	E0A7D019F01D957514AD0994B68E112C46389C66022F95FAD50B43495DAB73B2
SHA-512:	720094E3C1F57BEE43044575CFC0ED6673789ECF70FA897939C670AF31AA934D6C5EB2F1363F999879A9DE88A5D8735E5E6CB84FF9C0B58F85C6496B37C96441
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.5.6.5.1.1.0.8.7.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.a.9.c.c.3.0.3.-.3.e.c.6.-.4.7.f.1.-.8.d.5.0.-.1.7.d.3.1.2.3.7.8.2.9.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.b.d.7.e.2.d.f.-.6.a.6.0.-.4.4.3.5.-.a.6.a.8.-.4.8.d.1.5.1.5.4.e.d.0.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.0.-.0.0.0.1.-.0.0.1.4.-.3.e.d.0.-.f.3.7.2.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_b150831a-ad0d-4b32-98f8-831394925195\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9898736830150473
Encrypted:	false
SSDEEP:	192:zBL3BxvEPlk056rPI3jpSZrYTBzuiFAZ24IO8TVB:97vENf56rIj/zuiFAY4IO8X
MD5:	F52A82D31E7B5E815EADD50DC22BF846
SHA1:	FFD8E182FCC0206FA0F70D934B5BF88B3566DDE9
SHA-256:	779F77D11ABE731EE97BAC7E8C5AA59D39759E8AE8EE077C53C581EE2643921F
SHA-512:	17E4EDDB7849C29FF7C49174B8440F0725667276B58B497B778ABF611EDA7B441482BB3E4EC8D0526B6DC4DBFBE1E5F265F06249A4A6CEE6D53E0DEBD29747CE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.5.9.2.9.1.7.4.6.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.1.5.0.8.3.1.a.-.a.d.0.d.-.4.b.3.2.-.9.8.f.8.-.8.3.1.3.9.4.9.2.5.1.9.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.d.1.1.8.0.a.3.-.3.4.3.d.-.4.9.6.6.-.9.0.c.b.-.f.d.0.3.0.5.8.c.9.e.6.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.0.-.0.0.0.1.-.0.0.1.4.-.3.e.d.0.-.f.3.7.2.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_b8d96110-c9fb-424d-a33b-5f55f8d8ed4e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0159657983771808
Encrypted:	false
SSDEEP:	192:tBL3BxvQPlk056rPI3jpSZrYTjzuiFAZ24IO8TVB:T7vQNf56rIj9zuiFAY4IO8X
MD5:	C18A21E90310B42E43745A50A12F8538
SHA1:	3F5CDBD5503278402C220FD7B587D9F23B2E762A
SHA-256:	9CBD70D15346F2C11110C263DE12641B83529F9EBED5BE9B0564FFC3802C5C77
SHA-512:	6F42D991097B81470EA5B8B8E6D841292AC2FE9EADBEE01F6C0C2731AB16B2234083EDC7AC83232744AC21941769A6C8C5B204EBB9990C6C7674E17CA1B64849
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.6.6.4.9.4.6.9.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.8.d.9.6.1.1.0.-.c.9.f.b.-.4.2.4.d.-.a.3.3.b.-.5.f.5.5.f.8.d.8.e.d.4.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.9.1.a.e.7.3.7.-.9.b.d.1.-.4.d.f.8.-.a.a.b.4.-.7.2.f.0.0.0.4.f.a.2.d.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.0.-.0.0.0.1.-.0.0.1.4.-.3.e.d.0.-.f.3.7.2.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_dc311b2a-bab5-4e6b-947c-da0882de2d5b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.9223742280188229
Encrypted:	false
SSDEEP:	192:iRBL3BxvKPlk056rPI3jpSZrYPzuiFRZ24IO8TVB:C7vKNf56rIj9zuiFRY4IO8X
MD5:	006CE11C829700D6CB74425C1B952FB9
SHA1:	96FF7CCCEE5889E8C6E80078B8B25D5F5F4F5FC6
SHA-256:	3A61CF5DE987C3E7C7BE3A2165D6B1D9D18F68C61D47C48ADEBD24749DFC71E4
SHA-512:	527FAA8E6300E5A684FC992F264D81A143EB24D00E668352940D5DE64F9382D05B40756DC476DE5B9A0E93AE790B9736BC84F8D70FB7504593732CB062E3DBF3
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.5.3.2.3.5.2.5.7.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.c.3.1.1.b.2.a.-.b.a.b.5.-.4.e.6.b.-.9.4.7.c.-.d.a.0.8.8.2.d.e.2.d.5.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.5.4.8.a.e.4.6.-.6.2.0.e.-.4.e.8.b.-.a.a.d.0.-.f.f.7.3.3.4.d.b.6.d.5.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.0.-.0.0.0.1.-.0.0.1.4.-.3.e.d.0.-.f.3.7.2.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_e1758707-7d75-4927-bfcd-905886584b83\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9163424792575441
Encrypted:	false
SSDEEP:	192:TBL3BxvFPlk056rPI3jpSZrY9zuiFRZ24IO8TVB:d7vFNf56rIjvzuiFRY4IO8X
MD5:	69719C9590ECB0FCBD9879F622237C79
SHA1:	D38648310286E12CC9F32B4F8F791E361DD77818
SHA-256:	D4063F24D516C9602E242E983616F4E8DCCFF51A4E5DA55B2AC765B282DACBB0
SHA-512:	E513426D074AE8CC83C243D0319C8E1CD2AAED23E754B287B91A62E8868A2F368670CEDA0A732A4950F02C7B886F7759D96F523E709D5C4E8E549CAC2EE7A827
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.5.2.1.8.2.3.9.6.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.1.7.5.8.7.0.7.-.7.d.7.5.-.4.9.2.7.-.b.f.c.d.-.9.0.5.8.8.6.5.8.4.b.8.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.d.f.b.7.4.1.4.-.1.0.2.a.-.4.9.6.3.-.a.8.d.5.-.7.b.8.e.5.2.a.9.7.b.8.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.0.-.0.0.0.1.-.0.0.1.4.-.3.e.d.0.-.f.3.7.2.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_f5f9e377-8adc-4276-a920-6dab30daf607\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9023641805835356
Encrypted:	false
SSDEEP:	192:kBL3BxvaPlk056rPI3jpSZrY3zuiFRZ24IO8TVB:47vaNf56rIjVzuiFRY4IO8X
MD5:	09D69961BCEC33250191F486D1657539
SHA1:	8907C3FB6A396FC4011DE5873FBA1A8695AA65FB
SHA-256:	DB8AF5DE43BD991D74BCED902052E73222123611955BF5F3F57AC47E4D728608
SHA-512:	56713015A6D38DEF77BBE925803B839BAF25725FA2E644D0DED294EB6F7C76D14C69D8ECC8CAB90428F7BFEC0441C112C9981A51D6F26F00409AE15BE79FEECE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.0.2.5.4.3.0.8.2.2.6.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.5.f.9.e.3.7.7.-.8.a.d.c.-.4.2.7.6.-.a.9.2.0.-.6.d.a.b.3.0.d.a.f.6.0.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.a.e.3.d.e.5.6.-.3.b.4.e.-.4.0.7.a.-.b.5.d.5.-.4.f.5.2.c.b.a.b.4.4.5.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.0.-.0.0.0.1.-.0.0.1.4.-.3.e.d.0.-.f.3.7.2.6.a.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.3.9.5.7.6.d.6.d.8.3.8.8.d.e.a.4.8.9.9.4.6.1.4.1.d.b.c.c.f.9.c.f.5.f.e.3.a.2.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DC0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:12 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	70816
Entropy (8bit):	2.292748778039401
Encrypted:	false
SSDEEP:	768:SyYyRoHNTvZNPaIVrCeP9q953C/QYaPA:iPBkurCes93jI
MD5:	61E93FB0770B18B70520FBDDE3DD2F1F
SHA1:	DDFA77FED1BD04BCCEC5E0D431ED36E8C153111B
SHA-256:	6E3DA551559F5BC5EB1EB6B68A0BEC53F30584582BAF4406EE9963191C56037C
SHA-512:	70F338B92A5968497F905095435C8F19FB836053ECA0C1EE236F72079E93BC742CA3398185C9B067CB8612CCE6F92BE08B1CC686AFEEF27250FB5CD190F085F5
Malicious:	false
Preview:	MDMP..a..... ......... f........................l...........<...t.......4....4..........`.......8...........T............&..........................................................................................................eJ......4.......GenuineIntel............T............. f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F09.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8348
Entropy (8bit):	3.703772043506577
Encrypted:	false
SSDEEP:	192:R6l7wVeJKCyA6uFSum6Y9Y9SU91wLgmfBQiJpBZ89bj4mvsfthm:R6lXJj6Jum6YgSU91wLgmfiFjmfC
MD5:	7571C88BEECD61B491275997CE457AF8
SHA1:	99A074A6105C0EA7056741D0382BFCE6A285809D
SHA-256:	025EEF60D289B9C73102909161E64B252E2A8C4FEFFD78D4500BEACC33229C77
SHA-512:	AE04FC33C3878EE2A0AF37F6594DC27BE2EC664B63BEA662833F55E6E6F418AC3100D78C74C022EA660D815BAF8B3FD22CBD7F25418298ECBB27C26163F7EF0B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F58.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	4.469784769700327
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPJg77aI9XEWpW8VY4Ym8M4Jd4Fp+q8qoioBCodd:uIjfxI7dd7V4JeAnBCodd
MD5:	5548BF5C097005CC736C8A7A1B523F42
SHA1:	C25EC74CBE99C18D2DF0C1CFF9493D42A30B6B40
SHA-256:	0DDFF3AD34A46EB0B19904811B27A868A7238AB123120CDB4426907C2B2B4884
SHA-512:	ACC00CB88E33D03FF01CD7CD8286D07073B9E199ACC400709C0AAD2977C32EF0104D3B54D63F6B7AE7FEC4DCD64884B1CEDCEC95FD230300073FDF5CB53B137B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285091" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER31B8.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:13 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	77068
Entropy (8bit):	2.2439962115070395
Encrypted:	false
SSDEEP:	384:N452CTPPNTvyJz2sJi54apVrCeP9O9kaRN953C/QcJqCtEZafofz:iwINTvE2AapVrCeP9q953C/QKEuIz
MD5:	A374C48CDF280EE9B8A8F3BE1A75D4B8
SHA1:	24329BD370DA4258C65AB0D577398F001491E4AF
SHA-256:	BB62C189BBE651810C620AA2C02A97FD831B4BD1FFFC565C228CE31C0FB679A0
SHA-512:	AF7F0F1C8775C605060872A5FF24FFB4C62FE42474C1623DE29936F26B887E7D10700F8063D14B6ACF140CE4FC77058A2BAB081BDFE28DF04D815C9913080BF0
Malicious:	false
Preview:	MDMP..a..... ......... f............$...............8.......<................8..........`.......8...........T............&..<...........L...........8...............................................................................eJ..............GenuineIntel............T............. f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER32D2.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.7027095455639136
Encrypted:	false
SSDEEP:	192:R6l7wVeJKCm6w6Y9aSUi1wLgmfBQiJpBG89ba4mvsfQ8em:R6lXJ46w6YgSUi1wLgmfi0amfB
MD5:	7FE2420712F3F8F25ACCCE6C80D7820D
SHA1:	EBB5C45BDE026EA98E356DE6486FBB371614AD78
SHA-256:	E99FD8CDB55C188B9EFCE559CD9EC7776B9F0BDADA68695370F2206FFFB9C4C2
SHA-512:	73076E8E0539EFADDBADF97F807F2398E38698F49C91CBD1369208E2C43E7CCC184DBC4310A491FC1FC984E26EEB55C29AF42DC7B5CB6E5996F22203BA8E1960
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3311.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	4.470213805688719
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPJg77aI9XEWpW8VYBYm8M4Jd4FNan+q8qoioBCodd:uIjfxI7dd7VpJIanAnBCodd
MD5:	014F15FA73A26196EBF2B5FC106CC405
SHA1:	9F92DF001880A9ED8C2A8F729D09903EA6831065
SHA-256:	B8E59F65AE8C75A28B39E685E57C6A3733CE2CE0C2348790CE150D2DF81F2990
SHA-512:	BB4F37174CA97270B03B3187A110F8352CF1C639A811B0A1DD2FA54187DB5E8CC7FEAFE7CC6CCFE7B9DACE4A61957761DF9028DB8F3D3F2E4FB261B682E6E13D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285091" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER365B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:14 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	81882
Entropy (8bit):	2.1715138253464135
Encrypted:	false
SSDEEP:	384:WR0Tl/5NTvzk82szxfnvOVrCeP9OOkaRN953CzQMJ6yAM2ZB05zDue:PRhNTvp2iRmVrCeP9J953CzQTLZqke
MD5:	66609B678B35F4CC37746DC75555CEE5
SHA1:	CBB7608C94E29A15CC2AE186215CF1B1C52E22EC
SHA-256:	F1217EE1B663DF5D7EAAF9D07A3DE74BAB330B8A1B1DEAB7479FEEE50B7B7900
SHA-512:	9E356900B24AED934D11F529CB921AB7FABB153143365E2CC80DE03CC436C024506C17AD9AD6BD8B7C784487DE023FA152FF4F693001C65CD589813BEC713632
Malicious:	false
Preview:	MDMP..a..... ......... f............T...............h.......<................<..........`.......8...........T...........H'..........................................................................................................eJ......D ......GenuineIntel............T............. f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3718.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.7003689982870602
Encrypted:	false
SSDEEP:	192:R6l7wVeJKCD6kFCI6Y95SUsCwLgmfBQiJpBM89bV4mvsfgHAHm:R6lXJt6kFCI6YjSUsCwLgmfiiVmfw
MD5:	C6EF1B2DB046038ABED77CE3F45D9BC5
SHA1:	40E4A528866C309C0AD336D067579DF6F1D51AA7
SHA-256:	74DDAE374200CF32A48CA9DCDC2AEF3C8CB10D129DBB10F2B6BC9F0D5459B119
SHA-512:	695A6A6D8C40C55B2ABF27A107B4DA587B2926C705878B1236D8E4182D5FBE27F286693FAAE5F9ED6CE78DA88446FA13E7EA95AB6F99149F3EF7DF39F59FFA31
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3786.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	4.469805755686946
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPJg77aI9XEWpW8VYoYm8M4Jd4FezX+q8qoioBCodd:uIjfxI7dd7VAJlzXAnBCodd
MD5:	4C5187F6C166FC1A43422AFB11E28860
SHA1:	E2E259D820465E47FD73482AFDC235C6093E12C3
SHA-256:	17AA075FA08DA49BAFC572B932B32EFD4C3FD93AF4197FB9D6BBA2C4F606450E
SHA-512:	530ACC4DB8DEEE98AD86BE2BA236127FE2E71A26A2A0E264EE617A7E26BD72C6911AB84115EA6ABD13185DE6242B29A3E36CD5EB74F23CC7275F7DC9E6A618A9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285091" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E98.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:16 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	95528
Entropy (8bit):	2.2688885234692333
Encrypted:	false
SSDEEP:	384:sOD9QcpNTvNa3bxfKbsQ3A9hBQeP9OOkaRN9G3CnQmBsWtJ465bNJlCC2w3kv90Z:B5VNTvNUEH3mBQeP9J9G3CnQi7bzlHU
MD5:	BF12761469850F2E7FB55D2F09BF0978
SHA1:	020C0537B4D349F6A2AD6556D5F670C3F6346F29
SHA-256:	A385FB6F97CDF5687CD7146083326E713279A46FFFFFB905EE1834A81814B868
SHA-512:	2CDF0D20A05EB40FF285A4988D0C0E6407C216FF73183B66B7F2D26FB361E498BBD2357AD3B8A70DF5FBA95B32709BFD1AEFFF07F532C87DE6997246184ACBBE
Malicious:	false
Preview:	MDMP..a..... ......... f....................................<................?..........`.......8...........T...........8-...G......................................................................................................eJ......t ......GenuineIntel............T............. f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4030.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.701097911060971
Encrypted:	false
SSDEEP:	192:R6l7wVeJKC26+6Y9gSU2jgmfBQiJpB+89bH4mvsf0ytm:R6lXJI6+6YqSU2jgmfisHmfo
MD5:	F9112794B16CA1596B3606D16ABA16C2
SHA1:	F2C2A3DF4B14764B9F9E710101DCD1DE1D092631
SHA-256:	034C5B5804C623035A49876EE9B65DF12F5E201EF63FE1BADAB808D0A9AE1740
SHA-512:	B5315169CED0CC52ED0B7D7F360DACD1F90DBB771F46196DDEF9B2B2EFD0D22EC017330898935C64D1176007B70B7317E98424BE3A436E57FF3DD8CD98BDE961
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4060.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	4.470348737632921
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPJg77aI9XEWpW8VYMYm8M4Jd4FGc+q8qoioBCodd:uIjfxI7dd7VMJ7cAnBCodd
MD5:	7B8A3A90DECD8EB2B4258301E409D539
SHA1:	F6F0962F3048DF2FA93846B9BE91EFC36DA70354
SHA-256:	0C41901F1882EA166DC3957AEEEEDAF209351D687CB9D999A4915C1829136251
SHA-512:	6CCB5703AABD546EAE4B1E8FEA842D0FEB8653B4069DA5548FE605C6B725502285F04DEFF503C75794BD3E50A646CF3CDE83E784DEA69D5DB57D48F2B00DB421
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285091" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4976.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:19 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	106324
Entropy (8bit):	2.2529239071392464
Encrypted:	false
SSDEEP:	768:NyaENTvg6L66YPZrKwfBQem9J9H3CrQSDjQPL:s3p660ZrDBQe69xSDji
MD5:	F652FCC03D810B01DD2E61FEA7197EBE
SHA1:	C296B9D252AE087D7ACDB3901D5C7623B04C601B
SHA-256:	B971ABCF4390DA6B723506201C7181966E4AFF65584DA607A32BB0949A80B294
SHA-512:	E42390FED9BE2594A4020DD6226012A7009BB9375651B5143BB067CB4BF90B930455471C3B4AFE2AE5F4DAAF8BFC15EFEF8D5E6F45395D47876D854530EF097F
Malicious:	false
Preview:	MDMP..a..... ......... f....................................<.... ......t...ZF..........`.......8...........T............7...g...........!...........#..............................................................................eJ.......#......GenuineIntel............T............. f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AFD.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.702024473544747
Encrypted:	false
SSDEEP:	192:R6l7wVeJKCD6g6Y9MSUbKgmfBQiJpBG89bw4mvsf+Qm:R6lXJN6g6Y2SUbKgmfi0wmfw
MD5:	3D906EABC67FFBD50D28D21ADF12547A
SHA1:	CB2DCB2737DC9D9A66FB3DA015D8683EC3FB0912
SHA-256:	1F598ED98C30925893ADC8D6A34830BD4DCA1DD4A5DF51B3928664C9BE0BECDF
SHA-512:	A419EB359C74114FAECAB4FF5E920618DC6C3F0D3776BB410C05C650374370F458439AF72B09587D17ADFE7DC471AB847D1DA1E412050DA6492C2ED286B0FE18
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B4C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	4.470705289519032
Encrypted:	false
SSDEEP:	48:cvIwWl8zs6Jg77aI9XEWpW8VYpYm8M4Jd4F2d+q8qoioBCodd:uIjfII7dd7VpJrAnBCodd
MD5:	102A6050BB6DF43454B783E48F0C6597
SHA1:	7E9B24648A9B495E8F3E1E246D07F72B54342B3E
SHA-256:	A1805EF6B879747AC2B25801B0C2C3C6B5B09EDE414014DD3AD29BC24F851C86
SHA-512:	8464370AB7B0AAADA86A6073E4E2F302A46C26D760A63DBE5637220335EFCB3978F76BB2B1D82E9843AE143011C1EEC442C64D6596EF6BB118D8E6B6304F0E0E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285092" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER53D6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	111782
Entropy (8bit):	2.122011895884375
Encrypted:	false
SSDEEP:	768:7dLtNTvFcoKCbgX9H3CfQAjW/kGD7BN1Z:7Ztc59lzTD/1Z
MD5:	25DA2774E88DA4FE845C8CE5840F5F69
SHA1:	A4AE70E50415399A74A7FAED719CF1E5CBA4DB14
SHA-256:	16C4903204A0A03FB3B61913A250D6AAC9F3F06D13109F0128B444978C114934
SHA-512:	F749D9C92FEBBD70075EBD98A49EEFE10D4914D0748B7CE52E50E9598C29313B4C405D9C23E26E52CBD52DC28917903FF29E47B7B8F98CB44BBA16A9DD54FAD7
Malicious:	false
Preview:	MDMP..a..... ......... f....................................<...."......$...tK..........`.......8...........T...........PG..Vm..........."...........$..............................................................................eJ......x%......GenuineIntel............T............. f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER56A6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.6989515829485855
Encrypted:	false
SSDEEP:	192:R6l7wVeJKCt6r/6Y9QSUmpgmfBQiJpBG89bw4mvsfIwm:R6lXJz6T6YKSUmpgmfiUwmfG
MD5:	C2ABB17B73721D0C3ED5BB0E07ED8478
SHA1:	0122D8AEAB4BCC6F051C9A23269D33CCFEA09CB1
SHA-256:	3FC0D9F0ACEDC108B0F19748A6D9D504F924E7100976EF95CA364621854D04EC
SHA-512:	493C19537966616D880E582688C46EEA7C5E1AEBC6B92EAE8AE4EC904841F0FD1C6966369621ED1963C936EBB536A3A08FE50C5AE32E57461A53EFF825E752DD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER56D6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	4.472119730397404
Encrypted:	false
SSDEEP:	48:cvIwWl8zs6Jg77aI9XEWpW8VY4Ym8M4Jd4FhU+q8qoioBCodd:uIjfII7dd7VoJpAnBCodd
MD5:	1542584062468556F20907D544BAB77E
SHA1:	DFEA0DB5BB1747BF8F637CF50CD4CE5560C6181F
SHA-256:	9D11FE6B272AC4F1F32AFF1C34E1C159A7A6604F7010CD8BEBCD4B952287C3EE
SHA-512:	DF466661BDCF46101C54C156E3F70A92A084FD5336AF231E6407B72E40C796BE247E349C0859335F17E3F08D03B13F732F3050C6BFDE5E85FB90C24B4E60770E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285092" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER65D7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	123754
Entropy (8bit):	2.0349062096176014
Encrypted:	false
SSDEEP:	768:fmOPCaNTv2WCBpXCHOCX9H3CfQKaYNBGm5S+bmu:fxPduXBEu+9lDYnGm59bH
MD5:	DF94E01EF3921F90C6F9D8845BDDB89B
SHA1:	B85271E70E115EFA20E063A32C09D13C39B05B1F
SHA-256:	4D84393C9EC5484F22B0081095B2252993614873905140D2B21AF27C9F6B57F1
SHA-512:	663C47EFD2AB695C036E83DD545F69C720D9B3D9EEE96EF3DCD7A1FCDD9CBB8846D397D23432940E0FB368EDDBEECF3FCF97D15B6A405D2FCA2211A62BE514FF
Malicious:	false
Preview:	MDMP..a..... ......... f............D...............X.......<....#..........lQ..........`.......8...........T............G.............T#..........@%..............................................................................eJ.......%......GenuineIntel............T............. f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C70.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.701731721568259
Encrypted:	false
SSDEEP:	192:R6l7wVeJKC16aQEb6Y9qSUi4gmfBQiJpBw89ba4mvsfG+m:R6lXJ76aQEb6YASUi4gmfi2amfW
MD5:	C17C46D5214EB9496B38BFE8B378DF2C
SHA1:	055CBE2F8002FA50AE6364631A114CBE8FF27FCE
SHA-256:	66F791747D47797F4AE3D03F1123BF4FD9ABAB74DA788DA5300488CF4E1F72AB
SHA-512:	411D1B0A49534D3AC269C9E779C97D96BB30C0649E5EA285578A40200E1671C8D250E3837518C1B3C67CAB929212B0539B29ED8F4E62560F43364C9289182AE2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CBF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	4.468356451010496
Encrypted:	false
SSDEEP:	48:cvIwWl8zs6Jg77aI9XEWpW8VYtYm8M4Jd4Fa+q8qoioBCodd:uIjfII7dd7VpJ9AnBCodd
MD5:	E871ABB7747BB79BE34481F822D2548D
SHA1:	78D04F490E2557F508CA7DDE924F96237AFBBD2E
SHA-256:	F666A963C9055BF3E7E784E5BC184A358484402377D45CE3419E10EFB89DACE7
SHA-512:	7777FF8AD4E0ADAE0A984BB74ACA0017D699E991B6E0A5CA937C3AF1785CB1EE45B574FB8B6400D7488489807F19F8C758A2B6AE412F318D114B9B943CC363FC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285092" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6EFF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:29 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	58054
Entropy (8bit):	2.2300536080721054
Encrypted:	false
SSDEEP:	384:zNKa7sNTv9n0kdsqmtb3D65k9f93C1H/nMAQ6B:8gsNTvqmdGZ93C1HvQ6
MD5:	13740BCDB4FEF4A1D8FB10866B1FCFD6
SHA1:	10683D1304B58ADDDE502C6F3BB3248566E00210
SHA-256:	60E66B08E47D4B8A0B6E2E2610993FA23EAFD5298D710D46C1E60D16BE6AB781
SHA-512:	EAFC49EBA45B6AF2BCD3416CD5F614523B5B3956E103ED16AA006423D23149DF56C7165CD1020F6ADF50124A27BE7092171DBD142ACA4F7F1F9A6B62A73BD23B
Malicious:	false
Preview:	MDMP..a..... ......... f........................(...........$...........t..../..........`.......8...........T............ ..6...........$...........................................................................................eJ..............GenuineIntel............T.......4..... f............................. ..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7058.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8372
Entropy (8bit):	3.702292877829732
Encrypted:	false
SSDEEP:	192:R6l7wVeJIr6I6Y9PSUU4gmfViJpBm89bjusffBm:R6lXJs6I6YVSUU4gmfVcjtfE
MD5:	91195A56A96C00D2B133C1C4ABC88666
SHA1:	6DBA1CB61D8C29D8B77D611DB46D07F5BE91BBA4
SHA-256:	FED38E2BBDDF72E816B198EB1A6029CB556C7A0B3A6125724D054D24430AB0D4
SHA-512:	00F03AD0DE9477F34BCBD3E87C929E8E76D0B166D1B8A2901016A3C8A52E87D0DA33EFE0182E1C79DD4E0940E260AADE1830FA81F19938054B5F9C3B0C0D707E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER70C6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4614
Entropy (8bit):	4.489547900384475
Encrypted:	false
SSDEEP:	48:cvIwWl8zs6Jg77aI9XEWpW8VYSYm8M4J/4Fh/R+q87VGoTLBCPKd:uIjfII7dd7VyJIJ6GoTFCPKd
MD5:	0FB8C0D4AAD80BDF0AC8240CDA3819C4
SHA1:	849A84F8A2F052B3C486365B2F7A2771D967D151
SHA-256:	225206FB6F43E13A449A1AA9867F9E8913895CE9D1064A2E381374E388DE4DA3
SHA-512:	7420356DF5FCD0A1A4E34EE3A27585B0E478667780089EF68BCB4A39EE31CE971E9D9DBA3BADC61459D9EAFD9E2DBE7D35D7483D551EA77EEFF5B4FA1046CC97
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285092" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER744E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:30 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	131534
Entropy (8bit):	2.0568358572619614
Encrypted:	false
SSDEEP:	768:iFgJNTvhP/VB4XwOvX9H3CfQvBcM2OR6VBiaK:iK/pXVBWf9lJcROR6VBS
MD5:	DF29722F47B97300DB5BE32FA0DCB42F
SHA1:	6ED370014C99B82176B4112852A5D64F3408F060
SHA-256:	5E683F785684283623DBD1C269B07E044C8E8A70E07D8491BD8CF4DA9E4E65B1
SHA-512:	8BB1399063DADE7323E4C6721D57C0BEC850C436E209FFD08B78EFD28D16AD795C5C22B1E41826D593BD4FCF831E0698FBEB318F95E9856632C12E3F261DD7AD
Malicious:	false
Preview:	MDMP..a..... ......... f............D...............X.......<....#...........R..........`.......8...........T...........hH..f...........,$...........&..............................................................................eJ.......&......GenuineIntel............T............. f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7653.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.7010612871642916
Encrypted:	false
SSDEEP:	192:R6l7wVeJKCx6F6Y9FSUXcgmfBQiJpBz89bT4mvsfxTRm:R6lXJ/6F6YPSUXcgmfifTmfK
MD5:	B4E36B32B96CB3ACCE5C58EAB78CBDA5
SHA1:	90314D059C461EFB7867668D13C5578A10FA2707
SHA-256:	5750CE72DF299ED648232F08CB2CA8FB46D80320C245A0B10CE1F8C3BB0F689C
SHA-512:	19B6C6A07E6A80DA4A14CBEC8D5EBD76329DF8AE63CFBA56DB84E470347DA57D2547D3F0471E205ADC251D4FEB3D3F2055A66E5AF9E12FD48353EEE84AAD4033
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER76D1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	4.471737079133167
Encrypted:	false
SSDEEP:	48:cvIwWl8zs6Jg77aI9XEWpW8VY2Ym8M4Jd4FV+q8qoioBCodd:uIjfII7dd7VyJeAnBCodd
MD5:	3C29C7A097549D29D30F788F07667D8F
SHA1:	70AC47C9F0262CF585B344EA556D70558E31763E
SHA-256:	307DC0F9C0D589E2F25DFB219B605E0832E4A23221371CE9A4377A91FAAC5697
SHA-512:	0B2825AC0EB76514425451C09A49181C39E9DEC65045F1AEA218D8E0E02526A254571C6604AC9C77BDF6135CAFEACFB3068B4F51DBDAF109EAB0683E99FF9EDB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285092" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER80E1.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:33 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	123746
Entropy (8bit):	2.064994177486639
Encrypted:	false
SSDEEP:	768:xTzt6NTvUhUSdqdwsXTLZX9H3C8Q+luRDO1tTd:VU6VdMwM59c+luRDAtTd
MD5:	CB6C70FAE27FBCEEB79FCFA78F18CC8C
SHA1:	9AB14CF0CD8B04A8A3AB1F9DD51010EDA234E12C
SHA-256:	96B237F3545E387B57842CF76AA7C5E55A6A74514F50B8EEBE866B4A7B1D3AF0
SHA-512:	DB03A3077C1AF9E9359D4B9AEE020AA0EEFB5F710B13583572D4EFE38B2BF7B9A7C2C14A1D55127D1B4CD2264D407F6A51EC34A2367E332DF3843A424F3FA4E6
Malicious:	false
Preview:	MDMP..a..... ......... f............D...............X.......l...\$..........xS..........`.......8...........T............J...............$...........&..............................................................................eJ......L'......GenuineIntel............T............. f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8382.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.7016750514448087
Encrypted:	false
SSDEEP:	192:R6l7wVeJKCQ6mG6Y96SULcgmfBAaAjA1JpB+89b34mvsfv7dm:R6lXJO6/6YgSULcgmfSaAjAT3mfvs
MD5:	83D073EE18C03FE6C29F8C318D9EF737
SHA1:	E1DD809AF275052513E2D4C083C9408FC2C5DB7E
SHA-256:	63DEC3C1ABB2499900B330340818A8B5F4C77FC4650744FD58F82A1497CEF329
SHA-512:	CF610B0ABB4866FD05B6FF53FB50AC5B2455F52EBB3DCF020E980CC34478B49EFFE0BB05EDFDB277E74737842ECBE7AAC7974271BECA96E210319937B38DCEBF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER844E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	4.471210629728155
Encrypted:	false
SSDEEP:	48:cvIwWl8zs6Jg77aI9XEWpW8VYAYm8M4JdQFv++q8CoioBCodd:uIjfII7dd7VYJ5QnBCodd
MD5:	7CE5B003B775C60822C4C4241A10EA01
SHA1:	E6E7DEDE0DE49CEB1B9ECC06F5448CF0DBF1EE2C
SHA-256:	63D1687280C34A3DD43C0D0BEE7C473ECC783EC20B99EAD716C067579C09DB56
SHA-512:	7A1DBCDD099FA67388E8BB9A24DE1D9149F54A31D3B2A62B316CB45AE399C4D3B019F467EBBAD8A2FBAEA1E4C4D51F7BB53C16B32EA073877D3B49E774A5453E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285092" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8834.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:35 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	75536
Entropy (8bit):	2.174028642126174
Encrypted:	false
SSDEEP:	384:GzYOIa5bB9NTvmu9YVvFosL8DfVAoXw6Pk9f93C1HG4H8yX/rGB:GUaprNTvmwYEm8rVAoXwj93C1HFXD0
MD5:	7097B3D49B323F4D44B7E638A050E4B1
SHA1:	AA8CAE4C714AE96183395AFAC2BCD9BB9FC38F0B
SHA-256:	49B7DEB2B0D8B26DEC159003B397420089918DE92FAAE61351C52307AABD329B
SHA-512:	EC64484E9D3E9A33D116822FD6C8A1A5C8C3B0F2E6084FDA5861934B65EC3F2942842C491B407B32BC78C4B22E99F9E83C0CF7F9E4EAFAED02B7F1A29FC4C6CA
Malicious:	false
Preview:	MDMP..a..... ......... f............$...............8.......<...........T....9..........`.......8...........T...........h%..............$...........................................................................................eJ..............GenuineIntel............T.......4..... f............................. ..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER89FA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8370
Entropy (8bit):	3.701646967725577
Encrypted:	false
SSDEEP:	192:R6l7wVeJIX62A6Y9OSUuwgmfViJpBv89buusfJnam:R6lXJQ6B6YESUuwgmfVrutfF
MD5:	FF5DD53742D70FB1811E78F405BC6DDF
SHA1:	ECF70F1FF666BEE9AEAC4F5A0104ECE620696252
SHA-256:	BD1B73A7083E108F019A599867F1C8443C5F0324851B97839272F4EC53A2C129
SHA-512:	802E2BEDA9371FC5B3FD3C5EFF6BB77683BF2F45234C32AEADC5151D221D54FD9F72A0DE99C77C8952F8435853DC11D5C613EA5A220671980882071A26D26BE8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A49.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4614
Entropy (8bit):	4.4880929446847295
Encrypted:	false
SSDEEP:	48:cvIwWl8zs6Jg77aI9XEWpW8VYXYm8M4J/4Fkq+q87VGoTLBCPKd:uIjfII7dd7VrJ7q6GoTFCPKd
MD5:	1C8E5CBCE9D8C20CC374A8804ED81B00
SHA1:	E4B96B3A1303F38B7822406786B4BA5F3C64E6A0
SHA-256:	7B412FDE2D72E2A34048743EFC89B3236D9B4BD8E578EA496A8412F5FE80A7CD
SHA-512:	24042848AC39B209ED3437506AE739D8FB22153F3E303516882633E8F6D6203151815BD1DF7363DE6E321F4829C244D4F91C5E118C45400A2309F108A7DFBE51
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285092" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8AE4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	118270
Entropy (8bit):	2.0906947454978506
Encrypted:	false
SSDEEP:	768:MuM/NTvfVh0wCPXtL0X9H3C8QU2GCEZn:MuEXVewMI9cU2MZ
MD5:	50C21CEA0982DEAF6B6677D4BE1E2297
SHA1:	68A1615CE1CC88DC2F4B4AB857A8DC65BC3CC480
SHA-256:	97F52D8946B8137C09ED754F86E1FDDD85414EEFB01AEC5BB746A272F0DFCCC7
SHA-512:	6AEC68B76763C2204BDA3C62E98A53CA8750E6A422956108033DD45A6429C8F86A786D61BB01D506135AB0F90F7B3BC772923E385281184B130E20DE0749A891
Malicious:	false
Preview:	MDMP..a..... ......... f............................(.......l...,$..........\|P..........`.......8...........T............J..>............$...........&..............................................................................eJ.......'......GenuineIntel............T............. f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C1D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.701824582945648
Encrypted:	false
SSDEEP:	192:R6l7wVeJKCY6/k6Y9MSUysgmfBAaAjA1JpBq89bF4mvsf43m:R6lXJm6s6YWSUysgmfSaAjAXFmfV
MD5:	39C8E86F9E39075FED18B69CE4B1B262
SHA1:	4CFB26FF285326CD2F97CC40A062293381F3F5D4
SHA-256:	BFFF10D48AF9A309A233DAD7AA041C5A3F18644BF9DA7A8CDE57ECE3FEA18235
SHA-512:	191A4D1039E27841991D3EA824F02C3ACD416C2A946E060930CEC0DB6015057ECE9590791168AEF38C2406106EBC223823E5D06E4C7C9382BE40CF0F9925178B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C5D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	4.467268918512374
Encrypted:	false
SSDEEP:	48:cvIwWl8zs6Jg77aI9XEWpW8VYMYm8M4JdQFJE+q8CoioBCodd:uIjfII7dd7VwJVQnBCodd
MD5:	7D666F7E62728C8E8AC51173F50FD030
SHA1:	3A7F7B3FD3907CAD6B04370DCB8286D8B1C4D5EE
SHA-256:	B36750F56E246FB5F09EDB918B211A8B76AF768FFF1843662C5B5E1DAC0E71ED
SHA-512:	50BF07BA60EA9BDB8C3409C57E410595F4F4B5D398347A1A0B6EE12ED062BB65374496AEC79F9A4AE539BAA50DACB5024E781EE6375AE65D7FE0EF44641AC98F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285092" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8EDB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:37 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	81132
Entropy (8bit):	2.1355145781051537
Encrypted:	false
SSDEEP:	384:o9fcQ/d7+NTvLPKVrseCYdVAoXw6Pk9f93C1HGmfbv3CpB0GR6K:oJ1/d+NTvLiB3VAoXwj93C1HHbpGUK
MD5:	85B54A060C5353C9BF695C5720B365E3
SHA1:	C3C18E72FF4D5C3E84B75E654B69AE3F2E719A32
SHA-256:	82DEDCD0B70CF4671452A9336CF2F3D1FCE2D532B4E075236FE344B7E630261E
SHA-512:	A1D790E9616FE3F47A1F845AA8415BD36236430B3EFC1B722DA74047C54C9C5A6E049C7B17DCD43A549D6CB7863C33CE333B3B71FF0BB68E5664B867225D59B5
Malicious:	false
Preview:	MDMP..a..... ......... f............T...............h.......<................<..........`.......8...........T............%..\...........T...........@...............................................................................eJ..............GenuineIntel............T.......4..... f............................. ..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FB7.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8370
Entropy (8bit):	3.7057935999042497
Encrypted:	false
SSDEEP:	192:R6l7wVeJIW6K6Y9fSUysgmfViJpBOx89b8usfAs0m:R6lXJB6K6YVSUysgmfVK8tfAG
MD5:	44408B7BE6C02816D9A86D122124661C
SHA1:	8D2311C68317A82037BB2257F81BBA282A54324D
SHA-256:	78C29384C4EB19E14B9452500671F94EA8184B13D43B47336C30C5C163C77611
SHA-512:	AD895E96E9296597AA32F5D47424F47882AD5D9B0D547E02B015918415895C0B3A6DB122152FA61E4CE9AD0CDAE8E920CCE74AC5C3B1BE7F144E04C5869AB2AE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9016.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4614
Entropy (8bit):	4.488275408005406
Encrypted:	false
SSDEEP:	48:cvIwWl8zs6Jg77aI9XEWpW8VYaYm8M4J/4FA6+q87VGoTLBCPKd:uIjfII7dd7VmJs6GoTFCPKd
MD5:	3B8A9578B0F3E581BDDF40ED280A9C7F
SHA1:	CE6FDEB041956356ADCC1C5F4E5192BB131D392B
SHA-256:	C10A42810C3618258B83120434A804E36B48D0A3D982657D4B77CE2229CE5CF4
SHA-512:	02CEE6543C7F31EEA17E4F3196B747ACE81D712D2762E46968DB4512C863ED0347840E7A9800F9E40B0A24B0BF670E46625730E3926DA01F8060735EFB63CEDC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285092" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA69.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	59188
Entropy (8bit):	2.2550159647197425
Encrypted:	false
SSDEEP:	384:3TgXMMBNTvPs+s+nFPkNO9kaRN953C/QbJXkEIOTEJHiP:k8MBNTvVZkNq953C/QIOTE
MD5:	08F5BF97D4F1AF334F8ADD4AFCBB8AC4
SHA1:	E0FD976C7972538FF69EAABCF3DCE2E2BF37D791
SHA-256:	930EE30573D83D018A9B679FEDC549E98D270507A388218E773513F1F338B624
SHA-512:	9D31CA81ED12E320B3670770969AD23F03DD74A91990BCBDA42D2EDB26DB0826EC7F40FC3A9EC3C422482D30FB642C21F19F4E4867CE6CC0C134E52EC5B1A495
Malicious:	false
Preview:	MDMP..a..... ......... f....................................$...l............0..........`.......8...........T...........H"..........................\|...............................................................................eJ..............GenuineIntel............T............. f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC4E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8344
Entropy (8bit):	3.700134159358479
Encrypted:	false
SSDEEP:	192:R6l7wVeJKCa6z6Y9dSU5qgmfBQiJpBr89b74mvsfgpm:R6lXJU6z6YHSU5qgmfi37mfD
MD5:	8B6E7983D11890AC3EA5B1724B9D41C1
SHA1:	FC2F01B0D0756A0F63D6CEA8396CB47084FD0BEB
SHA-256:	C08DB5841CF5F8D39B884488EA9FBCD1D51F9F9C15DF42F5E414E41FE5A1DC6A
SHA-512:	0372B76C10BF92AA5AC2636A89FCEFF7B89CC2653CD75DF5CCD3166CE745250F4E119E8A654E8AC1F23A40541958B2DB9443AA43EF278C4C4D7369A854DED106
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC7E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	4.470099500882921
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPJg77aI9XEWpW8VYRYm8M4Jd4FuN+q8qoioBCodd:uIjfxI7dd7VZJ3NAnBCodd
MD5:	3F5C3E43C256EF28309D24B07BD1C50B
SHA1:	4B6627C9131552A510B2C8588FBFC966841035C3
SHA-256:	2E5029DF96D9431D40F1A6A6D37B9A1DB9C26B0AC04C63942699F8E88B2AB36E
SHA-512:	CE5232682214E2D9C21097B30CC96E84EEFA7743DFDCE861399C5A21F35D868323FC9941224ACC05003AB65EF2BDA0D35F8D14EB1A52C32B965EC893951C4803
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285091" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	962560
Entropy (8bit):	7.713192136777905
Encrypted:	false
SSDEEP:	12288:oekLV5eBOkw6Qhe4Yh5wV/uVJuEk6sP4lX8DbDK45dg/bdlh84LZ8Xt8quJsHmrE:on6rhau/OglUbD5yb5LLuXBuJsH4
MD5:	265D5B8B9F603F0F5EF62F2C27449607
SHA1:	39576D6D8388DEA489946141DBCCF9CF5FE3A28F
SHA-256:	948D096A3931A22F116B93FFEEFB3A374834D8EB578620C0FFC83F3E468EED81
SHA-512:	9D4AC79A62FBD0CB1D76C48848AF7863DDA72BD16368250A2258B3D30A4DDDCB24C38AC62555222706041A5073CBC39D291B14ECDF222C7E04ADD5374403AF66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47% Antivirus: Virustotal, Detection: 48%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....0.e............................g............@.................................:........................................(..d.......p........................... ...8...................h....... ...@............................................text.............................. ..`.rdata.............................@..@.data....Q...@.......&..............@....rsrc...p...........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\OfCx6VeglYVpWTwI9NddWAo.zip

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5543
Entropy (8bit):	7.8990592469630245
Encrypted:	false
SSDEEP:	96:ZWGzqeAoMq+YK0KF8cAJiI2i+uCbpww72MmhGsqp0CjCiZX/3KJ/:tqASpF8wFRJmhG4Kx/6J/
MD5:	4AEB838408E0EAC40B20FF50BEF0A091
SHA1:	499A50C84DCD626266176B010E9B1530942FB0AE
SHA-256:	37B0DC292D72FE29E1DDA30DB9188737DCBCECBCA58544F1D6AAB9F7AAFE3768
SHA-512:	08AD02BBEEF03A9A0CD06134C340950D4877B817853C914A860FB52B4250705A16037A8E0B4DBF1D3555C20C5B632B3CE4227CE535D0567B6F2DCA653CD07A58
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\OfCx6VeglYVpWTwI9NddWAo.zip, Author: Joe Security
Preview:	PK.........S.X................Cookies\..PK.........S.XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\adobe39GtSuVzyOuE\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\adobe39GtSuVzyOuE\information.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7225
Entropy (8bit):	5.581748635754113
Encrypted:	false
SSDEEP:	192:xcv9LvAtphWhcBixJsn+VwMcPhhx1kFnhYbMqZBQBNJiba5J2lbduERBobB6sGoG:6ZvAtfWhcBixBynB
MD5:	CDE00CEC8BA42106ED590EE9C9F9FC74
SHA1:	AE5DC41A44E823FDD2E56A477A11808C060CC430
SHA-256:	C9CA068D5EEA772A0D3E7CB31876B39FEB6F4619996A288F11EDA048C0EAF42A
SHA-512:	5F27DF55B2E6AD82A71DF59DA567E465675131603FECB164EC4FD076D43EFCCB4C17119827FE405E404FA78B32AA195D6381D9B58E41CFE130D81A8982392861
Malicious:	false
Preview:	Build: gedro..Version: 1.9....Date: Thu Apr 18 10:29:37 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 661ed6a17208b11ac59c6cf1587792ea....Path: C:\Users\user\Desktop\file.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobe39GtSuVzyOuE....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 226533 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 18/4/2024 10:29:37..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe [784]..svc

C:\Users\user\AppData\Local\Temp\adobe39GtSuVzyOuE\passwords.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\adobeIl1ZoQx5ZnY2\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\adobeIl1ZoQx5ZnY2\information.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7232
Entropy (8bit):	5.583585926053725
Encrypted:	false
SSDEEP:	192:xLvlvAtphWhcBwxJsn+VwMcPhhx1kFnhYbMqZBQBNJiba5J2lbduERBobB6sGoSU:hlvAtfWhcBwxByQB
MD5:	CE144F3C6C6E26BBE4709CD6D5AC6CAB
SHA1:	411AF728CFA656C836F81BCF43744A49E40A4376
SHA-256:	F5603CF8A67D97F7FCD23E7C62019BFBA3D465C69EB6BACE2021236B1DE3A538
SHA-512:	C3DD4A5A9CB3AC5313F0915DAE098A7B9A8321509A2A39E0626F7772293F93CFF5EB5D809505A1F5DF7CF31864D8D18754634371C97F9DC3B16B9EA3441A6BF5
Malicious:	false
Preview:	Build: gedro..Version: 1.9....Date: Thu Apr 18 10:29:51 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 661ed6a17208b11ac59c6cf1587792ea....Path: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobeIl1ZoQx5ZnY2....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 226533 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 18/4/2024 10:29:51..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontd

C:\Users\user\AppData\Local\Temp\adobeIl1ZoQx5ZnY2\passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\adobesyO6NvG6vZji\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\adobesyO6NvG6vZji\information.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7107
Entropy (8bit):	5.581686196717814
Encrypted:	false
SSDEEP:	192:xbvUvAtphWhcBwJsn+VwMcPhhx1kFnhYbMqZBQBNJiba5J2lbduERBobB6sGoSJ5:JUvAtfWhcBwBKB
MD5:	905A6E3D234FE37E59D18C45B27B66A4
SHA1:	8FC75A8DFCB46BC412F43F7DEE858D68D7FA959E
SHA-256:	5D5B82E5D321731056D174A5F687C0B2B2D1423C1676EE5DB29C2DB43D0ADAD7
SHA-512:	FCC6737AF83B1B1E652CB5ACC2C14FEDEEFFCD8364AA5479A4AE49DDE7382A1BCABC43307FD8D327D81187766F226354C1492EB391F27F1F34DFC3588EF17357
Malicious:	false
Preview:	Build: gedro..Version: 1.9....Date: Thu Apr 18 10:30:16 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 661ed6a17208b11ac59c6cf1587792ea....Path: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobesyO6NvG6vZji....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 226533 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 18/4/2024 10:30:16..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontd

C:\Users\user\AppData\Local\Temp\adobesyO6NvG6vZji\passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dSyaNbAby9QXs4RBu3VN33H.zip

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5582
Entropy (8bit):	7.899541020398721
Encrypted:	false
SSDEEP:	96:AWbWGzqeAoMq+YK0KF8cAJiI2i+uCfJOZr+8v1SN8bioz3KJZIu9+:AWnqASpF8wF7gENNG3z6JZIu9+
MD5:	04F9600721DCCCE7402E930A3A7D1753
SHA1:	C3D1F20434A9D47067F5903BD60DAF6619E3A799
SHA-256:	282921443088D2F851B5AB05A59782FB6619A56B2DDBB84604759433E8CDE6C7
SHA-512:	CBB1E2D3895374A5817FD9F2F9083F27B9B53D9B3490B922D175C8956AFA9A6D81712ED20EDCF91ACE951921E5E3ADA1AF230B26B089A7F0F3D3ED262E9943D7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\dSyaNbAby9QXs4RBu3VN33H.zip, Author: Joe Security
Preview:	PK.........S.X................Cookies\..PK.........S.XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\e_uwnYJDOrnylP4tGD1vKSo.zip

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5593
Entropy (8bit):	7.900832209911
Encrypted:	false
SSDEEP:	96:5WGzqeAoMq+YK0KF8cAJiI2i+uOazEgwNElP0y2VEycQH3KJF:NqASpF8wFZfgduEZ66JF
MD5:	7DF263E0DF8C1A89B3E776E49343389B
SHA1:	A015ED514C291D1E5081E18FB83427F60B120D1A
SHA-256:	75CCD93FBC1FA8C552E00875E62B04B77CEA5B80A650C29314C830D7109543E4
SHA-512:	EA36E5F0143CC72750594BBFC1A4785135AB84CC4D597F93AF7650366030B331CFD6FDCDF35C5BD9C7AA9D34552FF33845A3B3FF2E8752192C3D2817474B67AE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\e_uwnYJDOrnylP4tGD1vKSo.zip, Author: Joe Security
Preview:	PK.........S.X................Cookies\..PK.........S.XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\2_TMjP6pWvYDLogin Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\9zMbGEqpE5COLogin Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\BOV292H0mxgEHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\FxAu1a1JDtB8Web Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\HeifOucJlv60Web Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\IcPAi7xok6iaHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\M94FW15qXt05Cookies

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\QkoBCD2tTFlpHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\eBt1v4cLiOqEWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\jTDil21rwmscLogin Data For Account

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\nXFtGKoHb21jHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\uHXLq2btT439Web Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\uYMQq4w30H95Web Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\weyqQCNm9HN2Web Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\2lqugrjeVJunWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\6_PbUyeA3kVjWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\AqkFZJnS_4eJHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\LZlzsFoefEVpHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\MKjdaszvj8XCLogin Data For Account

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\RY6RdEPM8E4dWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\TifxbkBvgKkFWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\ZTjqnM2lH92vCookies

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\_yiJuL8xeLPXLogin Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\d4QTaPGdbj7gHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\fotzzxFskzb6Web Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\rWOqT1UkdTpuHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\rzThZlFR926oLogin Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\tcNWocR92MUuWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\8Mse1jO6nK1IWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\GUahzsMvIC8wHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\MBSHfyCuKHxNHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\MGPDw7uupP6KLogin Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\NBCgMFNDNiM2Web Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\SjNa0HpZUcV6Login Data For Account

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\ToLgTrDbYUcjWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\Tx9lIpMUG2zOWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\UyyA_zbRMLWeHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\W_RHKqX26M1cHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\_EJYNzOMy_83Login Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\hZAEvdPucF1VCookies

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\ixjTP3QSda4xWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\yzmVLlOHIOgjWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.199687794731328
Encrypted:	false
SSDEEP:	3:L4WR9:UW9
MD5:	61B8C0C37BA2ADCB4446CB9F5FCC2E64
SHA1:	7B6AF136B68774E261CEAA9180A922B27A0A9B2B
SHA-256:	6C721B28161D3ED3921CECAD8B48FE080F6D00E30119FD6B5CC0978B9C1DA466
SHA-512:	61EB976E56ADEDB673BA713DE678DA6182B661F5533CB98F07EC651794BFDC10BA53410C8F4ED7F6BB6DD15C8E567366A060B593F18354B83207523293B9F4CA
Malicious:	false
Preview:	1713433884181

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465309802705716
Encrypted:	false
SSDEEP:	6144:RIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSbm:yXD94+WlLZMM6YFH1+m
MD5:	459B942B14E985B33025DAA58E9C96CB
SHA1:	655FF6794D298D9E54F8BE70AE821BE0CC3B903B
SHA-256:	852F15DFE2454BFCE309BE7065D35C515C57755FF326C01AF33045467E308106
SHA-512:	392DD067F9D6957B83992737000472354EDA839F0537E714355175D1C307FE117BE66C0CF1B1332F49BCB68D601D92CE1E2612D42673A130B6603CCA0727A3DB
Malicious:	false
Preview:	regf@...@....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...xj...............................................................................................................................................................................................................................................................................................................................................J.8L........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.713192136777905
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	file.exe
File size:	962'560 bytes
MD5:	265d5b8b9f603f0f5ef62f2c27449607
SHA1:	39576d6d8388dea489946141dbccf9cf5fe3a28f
SHA256:	948d096a3931a22f116b93ffeefb3a374834d8eb578620c0ffc83f3e468eed81
SHA512:	9d4ac79a62fbd0cb1d76c48848af7863dda72bd16368250a2258b3d30a4dddcb24c38ac62555222706041a5073cbc39d291b14ecdf222c7e04add5374403af66
SSDEEP:	12288:oekLV5eBOkw6Qhe4Yh5wV/uVJuEk6sP4lX8DbDK45dg/bdlh84LZ8Xt8quJsHmrE:on6rhau/OglUbD5yb5LLuXBuJsH4
TLSH:	EF25010277D1A8B1EE734A325E79D6A46A3EFC218E143B7B2B9C1D1F04710A1D672772
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....0.e...................

File Icon


Icon Hash:	494d496505514519

Static PE Info

General

Entrypoint:	0x4067b5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x650B30FA [Wed Sep 20 17:50:50 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3c62679fe3cea3c660b4a0b83c80e478

Entrypoint Preview

Instruction
call 00007F989D24CA4Dh
jmp 00007F989D2428A5h
push 00000014h
push 004222D0h
call 00007F989D249E6Ah
call 00007F989D244CF9h
movzx esi, ax
push 00000002h
call 00007F989D24C9E0h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F989D2428A6h
xor ebx, ebx
jmp 00007F989D2428D5h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F989D24288Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F989D24287Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F989D2428ABh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F989D2499C0h
test eax, eax
jne 00007F989D2428AAh
push 0000001Ch
call 00007F989D242981h
pop ecx
call 00007F989D248E84h
test eax, eax
jne 00007F989D2428AAh
push 00000010h
call 00007F989D242970h
pop ecx
call 00007F989D24CA59h
and dword ptr [ebp-04h], 00000000h
call 00007F989D24BBFFh
test eax, eax
jns 00007F989D2428AAh
push 0000001Bh
call 00007F989D242956h
pop ecx
call dword ptr [0041A0CCh]
mov dword ptr [02DB91C4h], eax
call 00007F989D24CA74h
mov dword ptr [004DD98Ch], eax
call 00007F989D24C417h
test eax, eax
jns 00007F989D2428AAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x22884	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x29ba000	0xf070	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1a220	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x21368	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x21320	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1a000	0x198	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x18eda	0x19000	62509bf8fa0c58ad883b5af906ba6344	False	0.57759765625	data	6.673644768223166	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1a000	0x91ea	0x9200	8a1f7187b1a9fd064604f3ba4e748abf	False	0.3885916095890411	data	4.872361647984149	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x24000	0x29951c8	0xb9800	e11d86f420c67affac608849e8346fe7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x29ba000	0xf070	0xf200	88e084c96dffdc92e0d0ced1e6ab08cd	False	0.3863313533057851	data	4.364357540847168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x29c5998	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x29c5ac8	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x29c5ba0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x29c6a48	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x29c72f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_ICON	0x29ba5e0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.35794243070362475
RT_ICON	0x29bb488	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4729241877256318
RT_ICON	0x29bbd30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4627593360995851
RT_ICON	0x29be2d8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.47162288930581614
RT_ICON	0x29bf380	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5
RT_ICON	0x29bf838	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.4925373134328358
RT_ICON	0x29c06e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4675090252707581
RT_ICON	0x29c0f88	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.43713872832369943
RT_ICON	0x29c14f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.27717842323651454
RT_ICON	0x29c3a98	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.2901031894934334
RT_ICON	0x29c4b40	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.31188524590163935
RT_ICON	0x29c54c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.3351063829787234
RT_STRING	0x29c7a68	0x46e	data	Romanian	Romania	0.4470899470899471
RT_STRING	0x29c7ed8	0x5e6	data	Romanian	Romania	0.43112582781456954
RT_STRING	0x29c84c0	0x1d6	data	Romanian	Romania	0.48723404255319147
RT_STRING	0x29c8698	0x2b4	data	Romanian	Romania	0.4956647398843931
RT_STRING	0x29c8950	0x4ce	data	Romanian	Romania	0.45447154471544715
RT_STRING	0x29c8e20	0x250	data	Romanian	Romania	0.48817567567567566
RT_GROUP_CURSOR	0x29c5b78	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x29c7858	0x30	data			0.9375
RT_GROUP_ICON	0x29bf7e8	0x4c	data	Romanian	Romania	0.75
RT_GROUP_ICON	0x29c5930	0x68	data	Romanian	Romania	0.7115384615384616
RT_VERSION	0x29c7888	0x1e0	data			0.5541666666666667

Imports

DLL	Import
KERNEL32.dll	GetNumaProcessorNode, GetLocaleInfoA, LoadLibraryExW, GetUserDefaultLCID, CreateHardLinkA, GetNumberFormatA, GlobalFindAtomA, LoadLibraryW, ReadConsoleInputA, WriteConsoleW, GetModuleFileNameW, GetCompressedFileSizeA, SetThreadLocale, GetLastError, FindVolumeMountPointClose, VirtualAlloc, CreateTimerQueueTimer, CopyFileA, FindFirstChangeNotificationW, LocalAlloc, GetExitCodeThread, AddAtomW, RemoveDirectoryW, SetCommMask, GetOEMCP, VirtualProtect, SetCalendarInfoA, GetWindowsDirectoryW, GetCurrentProcessId, AddConsoleAliasA, GetTempPathA, WriteProcessMemory, SetFileAttributesW, GetVolumeInformationW, CreateThread, CreateFileW, SetStdHandle, DebugActiveProcess, OutputDebugStringW, FlushFileBuffers, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, HeapFree, GetCommandLineA, GetCPInfo, RaiseException, RtlUnwind, HeapAlloc, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetModuleHandleW, GetProcAddress, LCMapStringW, GetLocaleInfoW, IsValidLocale, EnumSystemLocalesW, IsValidCodePage, GetACP, GetCurrentThreadId, IsDebuggerPresent, GetProcessHeap, ExitProcess, GetModuleHandleExW, HeapSize, GetStdHandle, GetFileType, CloseHandle, GetModuleFileNameA, WriteFile, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, ReadFile, SetFilePointerEx, GetConsoleCP, GetConsoleMode
USER32.dll	GetMenuItemID
GDI32.dll	GetCharacterPlacementW
WINHTTP.dll	WinHttpReadData

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/18/24-10:30:16.680980	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49740	58709	192.168.2.4	147.45.47.93
04/18/24-10:29:08.862568	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49730	147.45.47.93	192.168.2.4
04/18/24-10:29:04.926205	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49730	147.45.47.93	192.168.2.4
04/18/24-10:29:38.779297	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49730	58709	192.168.2.4	147.45.47.93
04/18/24-10:30:10.701508	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49746	58709	192.168.2.4	147.45.47.93
04/18/24-10:30:15.638714	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49747	58709	192.168.2.4	147.45.47.93
04/18/24-10:29:04.737548	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49730	58709	192.168.2.4	147.45.47.93
04/18/24-10:30:04.701296	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49739	58709	192.168.2.4	147.45.47.93
04/18/24-10:29:35.017563	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49739	147.45.47.93	192.168.2.4
04/18/24-10:30:09.489545	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49747	147.45.47.93	192.168.2.4
04/18/24-10:29:31.522217	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49739	147.45.47.93	192.168.2.4
04/18/24-10:29:40.034897	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49740	147.45.47.93	192.168.2.4
04/18/24-10:30:07.590057	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49746	147.45.47.93	192.168.2.4
04/18/24-10:30:11.578830	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49746	147.45.47.93	192.168.2.4
04/18/24-10:30:11.622681	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49747	147.45.47.93	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 10:29:04.480011940 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:04.701898098 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:04.704449892 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:04.737548113 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:04.926204920 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:04.982208014 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:04.999844074 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:08.048443079 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:08.310342073 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:08.862567902 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:08.966583967 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:10.555253029 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:10.654092073 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:13.153161049 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:13.263562918 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:13.321137905 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:13.588752985 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:18.163747072 CEST	49737	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:18.163796902 CEST	443	49737	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:18.163880110 CEST	49737	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:18.189075947 CEST	49737	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:18.189101934 CEST	443	49737	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:18.420614004 CEST	443	49737	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:18.420686960 CEST	49737	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:18.424762964 CEST	49737	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:18.424778938 CEST	443	49737	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:18.425136089 CEST	443	49737	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:18.636131048 CEST	443	49737	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:18.636183023 CEST	49737	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:21.025114059 CEST	49737	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:21.072119951 CEST	443	49737	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:21.156280041 CEST	443	49737	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:21.156574965 CEST	443	49737	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:21.156646967 CEST	49737	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:21.158799887 CEST	49737	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:21.158838034 CEST	443	49737	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:21.158869982 CEST	49737	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:21.158885002 CEST	443	49737	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:21.285820007 CEST	49738	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:21.285903931 CEST	443	49738	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:21.285984993 CEST	49738	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:21.286267042 CEST	49738	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:21.286298990 CEST	443	49738	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:21.511044979 CEST	443	49738	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:21.511133909 CEST	49738	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:21.512711048 CEST	49738	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:21.512738943 CEST	443	49738	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:21.513150930 CEST	443	49738	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:21.514337063 CEST	49738	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:21.556123018 CEST	443	49738	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:21.853869915 CEST	443	49738	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:21.854103088 CEST	443	49738	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:21.854295015 CEST	49738	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:21.854489088 CEST	49738	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:21.854531050 CEST	443	49738	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:21.854568005 CEST	49738	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:21.854583025 CEST	443	49738	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:21.855237007 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:22.120444059 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:22.545696020 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:22.763472080 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:24.123312950 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:24.362668991 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.456940889 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:24.457683086 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:24.691339970 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.691354990 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.691366911 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.691395998 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.691435099 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:24.691437960 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.691452980 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.691466093 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.691469908 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:24.691478968 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.691492081 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:24.691493034 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.691507101 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.691518068 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:24.691545963 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:24.916424990 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.916441917 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.916496992 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:24.916562080 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.916739941 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.916754961 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:24.916779995 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:24.966640949 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:25.024714947 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:25.266612053 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:25.341705084 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:25.611929893 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:25.855520010 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:25.966687918 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:31.085223913 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:31.303626060 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:31.303714991 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:31.353421926 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:31.522217035 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:31.616297960 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:31.638545036 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:34.685494900 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:34.948818922 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:35.017563105 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:35.138504982 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:35.725924969 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:35.826009989 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:36.044375896 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:36.138511896 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:37.045346975 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:37.306499958 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:38.779297113 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:39.053287983 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:39.481781960 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:39.597661018 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:39.654237986 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:39.816262960 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:39.816462040 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:39.837074995 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:40.034897089 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:40.104358912 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:40.154145002 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:40.372591972 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:40.466644049 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:40.513704062 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:40.592116117 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:40.592160940 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:40.592245102 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:40.593318939 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:40.593343019 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:40.776199102 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:40.815577030 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:40.815634966 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:40.817361116 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:40.817369938 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:40.817692041 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:40.935385942 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:42.510308981 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:42.552118063 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:42.647994041 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:42.648113012 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:42.648359060 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:42.648631096 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:42.648652077 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:42.648669958 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:42.648677111 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:42.652565956 CEST	49742	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:42.652596951 CEST	443	49742	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:42.652673006 CEST	49742	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:42.652977943 CEST	49742	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:42.652992964 CEST	443	49742	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:42.868295908 CEST	443	49742	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:42.868376970 CEST	49742	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:42.869816065 CEST	49742	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:42.869829893 CEST	443	49742	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:42.870100975 CEST	443	49742	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:42.871510983 CEST	49742	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:42.916121006 CEST	443	49742	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:43.217190981 CEST	443	49742	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:43.217278957 CEST	443	49742	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:43.217375040 CEST	49742	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:43.511898041 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:43.512176037 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:43.696193933 CEST	49742	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:43.696230888 CEST	443	49742	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:43.698014975 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:43.776177883 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:43.964008093 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:43.969062090 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:43.982923985 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:44.245280027 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:44.922626019 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:45.182862997 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:45.437072039 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:45.574596882 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:45.638667107 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:45.654268980 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:46.078507900 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:46.338785887 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.361679077 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.361830950 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.361843109 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.361854076 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.361870050 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.361876965 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:46.361892939 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:46.361898899 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.361912966 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.361927032 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.361941099 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:46.361952066 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.361963987 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.361974955 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:46.362001896 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:46.583328962 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.583482027 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.583494902 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.583513021 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.583528042 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.583539963 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:46.583587885 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:46.622967958 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:46.835642099 CEST	49743	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:46.835673094 CEST	443	49743	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:46.835753918 CEST	49743	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:46.836954117 CEST	49743	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:46.836970091 CEST	443	49743	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:46.875559092 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:46.935440063 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:46.951150894 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:47.058921099 CEST	443	49743	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:47.059017897 CEST	49743	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:47.060256958 CEST	49743	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:47.060264111 CEST	443	49743	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:47.061342001 CEST	443	49743	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:47.202055931 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:47.263598919 CEST	49743	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:47.326046944 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:47.865735054 CEST	49743	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:47.912130117 CEST	443	49743	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:47.998555899 CEST	443	49743	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:47.998893976 CEST	443	49743	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:47.998976946 CEST	49743	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:47.999136925 CEST	49743	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:47.999161959 CEST	443	49743	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:47.999181032 CEST	49743	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:29:47.999191046 CEST	443	49743	34.117.186.192	192.168.2.4
Apr 18, 2024 10:29:48.007915020 CEST	49744	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:48.007950068 CEST	443	49744	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:48.008116961 CEST	49744	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:48.008315086 CEST	49744	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:48.008341074 CEST	443	49744	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:48.231945038 CEST	443	49744	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:48.232027054 CEST	49744	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:48.809346914 CEST	49744	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:48.809364080 CEST	443	49744	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:48.809773922 CEST	443	49744	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:48.811939955 CEST	49744	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:48.852121115 CEST	443	49744	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:49.016307116 CEST	443	49744	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:49.016396999 CEST	443	49744	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:49.016539097 CEST	49744	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:49.016690016 CEST	49744	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:49.016707897 CEST	443	49744	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:49.016733885 CEST	49744	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:29:49.016755104 CEST	443	49744	104.26.4.15	192.168.2.4
Apr 18, 2024 10:29:49.017139912 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:49.276429892 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:52.810661077 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:52.810755014 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:53.032233000 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:53.032280922 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:53.307497025 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:29:55.841995955 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:29:56.063532114 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:00.780034065 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:00.810933113 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:01.073508024 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:01.188863993 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:01.188863993 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:01.407455921 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:01.407475948 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:01.407584906 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:01.667211056 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:04.701296091 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:04.717041016 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:04.936168909 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:07.146893024 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:07.368458986 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:07.368554115 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:07.380073071 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:07.590056896 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:07.651559114 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:07.732347012 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:09.051378965 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:09.270797968 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:09.270912886 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:09.280766964 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:09.288727045 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:09.326086998 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:09.374373913 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:09.489545107 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:09.544930935 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:09.557600975 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:09.636127949 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:10.386878014 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:10.387119055 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:10.701508045 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:10.924354076 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:10.924376965 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:10.924388885 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:10.924401999 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:10.924415112 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:10.924428940 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:10.924448967 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:10.924467087 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:10.924480915 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:10.924496889 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:10.924617052 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:10.924736977 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:10.963987112 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:11.143111944 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:11.143138885 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:11.143153906 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:11.143167973 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:11.143183947 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:11.143268108 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:11.143435955 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:11.232422113 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:11.303364038 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:11.349241972 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:11.357372999 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:11.404236078 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:11.495465994 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:11.578830004 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:11.622680902 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:11.623008013 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:11.669858932 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:12.014692068 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:12.060693979 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:12.107537985 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:12.199933052 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:12.229641914 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:12.248013973 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:12.279331923 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:12.308712006 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:12.308842897 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:12.370112896 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:12.437618971 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:12.482331991 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:12.511204004 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:12.668227911 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:12.716711044 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:12.776336908 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:12.933665037 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:12.982350111 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:13.184067965 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:13.448396921 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:13.509038925 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:13.733345985 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:13.733401060 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:13.733463049 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:13.734801054 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:13.734816074 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:13.745253086 CEST	49749	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:13.745282888 CEST	443	49749	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:13.745342016 CEST	49749	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:13.746412992 CEST	49749	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:13.746428967 CEST	443	49749	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:13.776545048 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:13.956914902 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:13.956990004 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:13.958483934 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:13.958498955 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:13.958811998 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:13.969749928 CEST	443	49749	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:13.969839096 CEST	49749	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:13.971666098 CEST	49749	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:13.971674919 CEST	443	49749	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:13.972491026 CEST	443	49749	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:14.013580084 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:14.014370918 CEST	49749	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:15.437793970 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:15.475986958 CEST	49749	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:15.480123997 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:15.516130924 CEST	443	49749	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:15.571181059 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:15.571522951 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:15.571583033 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:15.571737051 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:15.571758032 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:15.571774006 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:15.571779966 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:15.573734045 CEST	49750	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:15.573765993 CEST	443	49750	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:15.573954105 CEST	49750	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:15.574409962 CEST	49750	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:15.574425936 CEST	443	49750	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:15.609733105 CEST	443	49749	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:15.609864950 CEST	443	49749	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:15.609925985 CEST	49749	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:15.610260963 CEST	49749	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:15.610282898 CEST	443	49749	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:15.610306978 CEST	49749	443	192.168.2.4	34.117.186.192
Apr 18, 2024 10:30:15.610313892 CEST	443	49749	34.117.186.192	192.168.2.4
Apr 18, 2024 10:30:15.615479946 CEST	49751	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:15.615519047 CEST	443	49751	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:15.615820885 CEST	49751	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:15.616163015 CEST	49751	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:15.616182089 CEST	443	49751	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:15.638714075 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:15.797445059 CEST	443	49750	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:15.797516108 CEST	49750	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:15.836080074 CEST	443	49751	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:15.836148024 CEST	49751	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:15.901771069 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:16.264626026 CEST	49750	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:16.264657974 CEST	443	49750	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.265786886 CEST	443	49750	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.267456055 CEST	49750	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:16.279737949 CEST	49751	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:16.279781103 CEST	443	49751	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.280149937 CEST	443	49751	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.281611919 CEST	49751	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:16.312124014 CEST	443	49750	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.324117899 CEST	443	49751	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.441598892 CEST	443	49750	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.441844940 CEST	443	49750	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.441906929 CEST	49750	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:16.441977978 CEST	49750	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:16.441993952 CEST	443	49750	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.442012072 CEST	49750	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:16.442017078 CEST	443	49750	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.442481995 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:16.457328081 CEST	443	49751	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.457427979 CEST	443	49751	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.457791090 CEST	49751	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:16.457837105 CEST	49751	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:16.457851887 CEST	443	49751	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.457869053 CEST	49751	443	192.168.2.4	104.26.4.15
Apr 18, 2024 10:30:16.457874060 CEST	443	49751	104.26.4.15	192.168.2.4
Apr 18, 2024 10:30:16.458205938 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:16.680979967 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:16.714173079 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:16.729604006 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:16.948194981 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:17.653800964 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:17.779259920 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:19.919013977 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:20.091759920 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:20.291917086 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:20.292560101 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:20.798018932 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:20.842061043 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:20.888710976 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:21.013632059 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:21.243944883 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:21.358130932 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:21.510782957 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:21.620575905 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:22.561589003 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:22.608364105 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:22.701132059 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:22.779223919 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:25.685532093 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:25.685580015 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:25.904118061 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:25.907056093 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:25.981169939 CEST	58709	49747	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:25.981197119 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:25.981261969 CEST	49747	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:25.981307983 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:27.420825958 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:27.420941114 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:27.639645100 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:27.639700890 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:27.639735937 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:27.639739990 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:27.901642084 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:30.483279943 CEST	49740	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 10:30:30.701900005 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:31.121978045 CEST	58709	49740	147.45.47.93	192.168.2.4
Apr 18, 2024 10:30:31.122035027 CEST	49740	58709	192.168.2.4	147.45.47.93

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 10:29:18.041536093 CEST	55437	53	192.168.2.4	1.1.1.1
Apr 18, 2024 10:29:18.146187067 CEST	53	55437	1.1.1.1	192.168.2.4
Apr 18, 2024 10:29:21.180342913 CEST	50748	53	192.168.2.4	1.1.1.1
Apr 18, 2024 10:29:21.285166025 CEST	53	50748	1.1.1.1	192.168.2.4
Apr 18, 2024 10:30:13.201637030 CEST	54553	53	192.168.2.4	1.1.1.1
Apr 18, 2024 10:30:13.306106091 CEST	53	54553	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 10:29:18.041536093 CEST	192.168.2.4	1.1.1.1	0x39b7	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:29:21.180342913 CEST	192.168.2.4	1.1.1.1	0x295f	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:30:13.201637030 CEST	192.168.2.4	1.1.1.1	0x86e2	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 10:29:18.146187067 CEST	1.1.1.1	192.168.2.4	0x39b7	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:29:21.285166025 CEST	1.1.1.1	192.168.2.4	0x295f	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:29:21.285166025 CEST	1.1.1.1	192.168.2.4	0x295f	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:29:21.285166025 CEST	1.1.1.1	192.168.2.4	0x295f	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
Apr 18, 2024 10:30:13.306106091 CEST	1.1.1.1	192.168.2.4	0x86e2	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	34.117.186.192	443	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 08:29:21 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 08:29:21 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 08:29:21 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 08:29:21 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 08:29:21 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	104.26.4.15	443	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 08:29:21 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 08:29:21 UTC	660	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 08:29:21 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471E2C:3062_93878F2E:0050_6620D9E1_8A0B400:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HmgaHY5j%2BqL8E47Rw4n8JxcHh7ytoqR1R%2Bf%2Fm7yt5iqS9Cd09qGFCLp%2BY2C9eAbFQpVcfmf22YDzjmWmFxuXNVUE%2FYBiNTI5jBOePAlWK6rtkr%2BabWnK83EjCA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87634962994fadd2-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 08:29:21 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-18 08:29:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	34.117.186.192	443	7988	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 08:29:42 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 08:29:42 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 08:29:42 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 08:29:42 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 08:29:42 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	104.26.4.15	443	7988	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 08:29:42 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 08:29:43 UTC	660	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 08:29:43 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC4546E9:B7E4_93878F2E:0050_6620D9F7_8A36ECB:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e7AH%2FE4gT%2F9k5vQ%2BWKSwOiFfvUAeBwndwY447miWGOXQagH%2BA4OljMze5CdRuUHR5wnaRlFzWH46bMT9VLtwL%2BTy3xHlH6FTTQg5otBw5o2bTM7rS4%2FGyanSIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876349e81d5a674f-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 08:29:43 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-18 08:29:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	34.117.186.192	443	2352	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 08:29:47 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 08:29:47 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 08:29:47 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 08:29:47 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 08:29:47 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	104.26.4.15	443	2352	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 08:29:48 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 08:29:49 UTC	660	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 08:29:48 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC454797:59C6_93878F2E:0050_6620D9FC_8A0B99B:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ol4GG5ug5N5NERZZANJSTHCY%2Bws23ert3WmM8TnwbmdY2N6Bh8zrySe1%2BSWzstXXo1Buob%2BHKPuYX%2BGZkI5Z%2Fl4q13aUNgKZDeJRDuB%2FjkvfZZrgobFvnQF0Ug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87634a0c583144e5-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 08:29:49 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-18 08:29:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	34.117.186.192	443	7584	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 08:30:15 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 08:30:15 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 08:30:15 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 08:30:15 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 08:30:15 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	34.117.186.192	443	7592	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 08:30:15 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 08:30:15 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 08:30:15 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 08:30:15 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 08:30:15 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49750	104.26.4.15	443	7584	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 08:30:16 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 08:30:16 UTC	658	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 08:30:16 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: 6CA2EE4C:7634_93878F2E:0050_6620DA18_8A37467:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=72hCCpcoOaaHEpoZMYYe0%2Bby7pwnBBapIME9kKOTYVVMTbSiY%2F5E9H5V6%2Fg36pazTKctNKo3rNENRpa5BmYQp2Gi3wezeR4OvWAWc2aGAvCuT%2Fqtx3p2LOoo%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87634ab7fc671f9d-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 08:30:16 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-18 08:30:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49751	104.26.4.15	443	7592	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 08:30:16 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 08:30:16 UTC	648	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 08:30:16 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471F62:F84C_93878F2E:0050_6620DA18_8A0BD97:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G2UsVHfwJ0Ebh38mdX6NCaCSKgwdoTkFZ1RqQNQpeJgabzettT35JmfBnaUwalalf5QzhIlw7uJagrIdSurwL7hNFds9Cr0vLfUFEjcTcS9yqyckeutEf9ec6w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87634ab808987be2-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 08:30:16 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-18 08:30:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:28:54
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	962'560 bytes
MD5 hash:	265D5B8B9F603F0F5EF62F2C27449607
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.2253726342.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2258287784.0000000007A6D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2256177341.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2256177341.000000000302E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2256109726.0000000002F51000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1698876622.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2257395722.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:29:02
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xa20000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:29:02
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:29:02
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xa20000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:29:02
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:29:02
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 784
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:29:03
Start date:	18/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x80000
File size:	962'560 bytes
MD5 hash:	265D5B8B9F603F0F5EF62F2C27449607
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000003.2345569703.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000008.00000002.2555613641.0000000004900000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.2554245395.0000000002F65000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.2552258510.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs Detection: 48%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:29:03
Start date:	18/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	962'560 bytes
MD5 hash:	265D5B8B9F603F0F5EF62F2C27449607
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.2555380044.0000000002FCE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000003.2355371299.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000002.2552333219.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000009.00000002.2555618433.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:29:11
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 960
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:29:13
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1008
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:29:14
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 996
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:29:14
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	962'560 bytes
MD5 hash:	265D5B8B9F603F0F5EF62F2C27449607
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2305959394.0000000003058000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000011.00000003.2307637364.0000000007A99000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000011.00000002.2350759257.0000000004A1C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.2349974931.0000000003002000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2343081719.0000000003065000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000011.00000002.2352946266.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000011.00000002.2351210254.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000011.00000003.1935064684.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.2350560658.0000000003069000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2307237063.0000000003058000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2307237063.0000000003002000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000011.00000002.2348884384.0000000002F7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000011.00000002.2345301493.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs Detection: 48%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:29:16
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1020
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:29:18
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1416
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:29:21
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1828
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:29:24
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	962'560 bytes
MD5 hash:	265D5B8B9F603F0F5EF62F2C27449607
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001A.00000002.2603079344.0000000002F47000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001A.00000002.2604404588.0000000007A40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001A.00000002.2603730581.0000000004A22000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001A.00000002.2601441093.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001A.00000003.2050121383.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001A.00000002.2603802110.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:29:26
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1848
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:29:28
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 820
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:29:29
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1808
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:29:32
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1940
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	10:29:35
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 940
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:29:35
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1948
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:29:36
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 952
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	19%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	93

Executed Functions

Function 0040E7B0 Relevance: 219.9, APIs: 12, Strings: 113, Instructions: 1182fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,7F7A790F,?,7F7A790E,00445E27,00000000,7F7A790E,7F7A790F,74DF3100,?), ref: 0040E929
CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,0051DAFC,00000001,0000002E,0000002F,?,00000000,00445E27), ref: 0040EBE2
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040EC55
FindNextFileA.KERNEL32(00000000,?), ref: 0040EC6B
FindClose.KERNEL32(00000000), ref: 0040EC7B
GetLastError.KERNEL32 ref: 0040EC81
GetLastError.KERNEL32 ref: 0040EC9F

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,74DF3100,?), ref: 0040EE16
CreateDirectoryA.KERNEL32(?,00000000,?,2121120E,?,01002F31,2121120E,2121120F,?,?,?,2121120E,2121120F,?,74DF3100,?), ref: 0040F00C
CreateDirectoryA.KERNEL32(00000000,00000000,?,313A1A0E,?,?,313A1A0E,313A1A0F,?,313A1A0E,?,00000000,313A1A0E,313A1A0F,?,2121120E), ref: 0040F16D

Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B24F
Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B260

CreateDirectoryA.KERNEL32(00000000,00000000,?,363B1F0E,?,?,363B1F0E,363B1F0F,?,363B1F0E,?,00000000,363B1F0E,363B1F0F,?,313A1A0E), ref: 0040F412
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,?,?,?,363B1F0E), ref: 0040F6C0

Strings

3/==, xrefs: 004122FD
3/==, xrefs: 0040F0D9
., xrefs: 004113CF
:2,*, xrefs: 0040FED0
9%!, xrefs: 004116BE
5817, xrefs: 004131EC
5817, xrefs: 004134B1
9:, xrefs: 0041242F
=>, xrefs: 00412DE1
3/==, xrefs: 004128EE
:2,*, xrefs: 0041008E
7;x, xrefs: 0040F364
12*y, xrefs: 00412702
7;x, xrefs: 0040F2B0
>:(, xrefs: 0040FCE9
9:, xrefs: 004129AD
751, xrefs: 00411895
5#*,, xrefs: 00410A68
79;<, xrefs: 00411E38
9%!, xrefs: 0041164A
', xrefs: 00410DF9
\, xrefs: 0040FF86
9:, xrefs: 004123BC
.4.<, xrefs: 0040F2B7
$39, xrefs: 0041219D
9:, xrefs: 00412A20
:2,w, xrefs: 0040FAF5
>9, xrefs: 00411ADB
7;x, xrefs: 00412A0C
5#*6, xrefs: 00411C4C
9:, xrefs: 004124C8
.4.<, xrefs: 00412AAF
6:3<, xrefs: 004136ED
7;x, xrefs: 0041241B
:2,w, xrefs: 0040FCE2
=8, xrefs: 00413196
?9, xrefs: 004135DF
.4.<, xrefs: 00411119
?9, xrefs: 004132B2
7;x, xrefs: 004123A8
9:, xrefs: 00412AB9
$39, xrefs: 0041211E
.4.<, xrefs: 004129A3
7;x, xrefs: 0041110D
9:, xrefs: 0040F2BE
3/==, xrefs: 00412861
9453, xrefs: 0041333F
7;x, xrefs: 00412999
4, xrefs: 0041351F
>:(, xrefs: 0040FC53
?9, xrefs: 00413399
3/==, xrefs: 00410F58
.4.<, xrefs: 004124BE
.4.<, xrefs: 0040F36E
8>,<, xrefs: 00413333
3/==, xrefs: 00412207
>2*, xrefs: 00411A6D
'^D, xrefs: 0040ED89
9:, xrefs: 00411017
3%7, xrefs: 00410C25
5817, xrefs: 00413003
9:, xrefs: 00411123
8>.), xrefs: 00410DEF
"64:, xrefs: 004136F7
7, xrefs: 004106E0
9>6, xrefs: 00413451
5#*,, xrefs: 004106D6
:2,*, xrefs: 004101A5
35, xrefs: 00413145
.4.<, xrefs: 0040F449
.4.<, xrefs: 00411080
9>6, xrefs: 00413691
5817, xrefs: 004137C6
3/==, xrefs: 0040F023
:2,w, xrefs: 0040FC4C
3/==, xrefs: 00412270
6, xrefs: 00411C60
.4.<, xrefs: 004123B2
8850, xrefs: 0041154A
7;x, xrefs: 0040F442
7, xrefs: 00412027
9:, xrefs: 0041108A
3/==, xrefs: 004127F8
12*y, xrefs: 00412782
7;x, xrefs: 00411003
3/==, xrefs: 00410E62
., xrefs: 0040E940
5817, xrefs: 00412F8A
3%=,, xrefs: 0041201D
.4.<, xrefs: 00412425
7;x, xrefs: 00412AA3
?9;6, xrefs: 00413139
7470, xrefs: 0041357C
5817, xrefs: 004133EF
2"+, xrefs: 004108A5
9>6, xrefs: 00413080
3470, xrefs: 00413513
9>6, xrefs: 00412F18
522, xrefs: 00413703
>., xrefs: 0040EF6F
), xrefs: 00413A8B
>, xrefs: 00413632
.4.<, xrefs: 0041100D
5817, xrefs: 00413767
9:, xrefs: 0040F450
7;x, xrefs: 004124B2
.4.<, xrefs: 00412A16
4, xrefs: 00413588
3/==, xrefs: 00410ECB
66"6, xrefs: 00413687
7;x, xrefs: 00411076
>2*w, xrefs: 00411AD1
;>;, xrefs: 0041051D

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateDirectory$File$ErrorFindLast$Cpp_errorThrow_std::_$AttributesCloseCopyFirstFolderNextPath
String ID: "64:$$39$$39$'$'^D$)$.$.$.4.<$.4.<$.4.<$.4.<$.4.<$.4.<$.4.<$.4.<$.4.<$.4.<$.4.<$.4.<$12*y$12*y$2"+$3%7$3%=,$3/==$3/==$3/==$3/==$3/==$3/==$3/==$3/==$3/==$3/==$3/==$3470$35$4$4$5#*,$5#*,$5#*6$522$5817$5817$5817$5817$5817$5817$5817$6$66"6$6:3<$7$7$7470$751$79;<$7;x$7;x$7;x$7;x$7;x$7;x$7;x$7;x$7;x$7;x$7;x$7;x$8850$8>,<$8>.)$9%!$9%!$9453$9:$9:$9:$9:$9:$9:$9:$9:$9:$9:$9:$9>6$9>6$9>6$9>6$:2,*$:2,*$:2,*$:2,w$:2,w$:2,w$;>;$=8$=>$>$>.$>2*$>2*w$>9$>:($>:($?9$?9$?9$?9;6$\
API String ID: 1240817490-3540293368
Opcode ID: 92d92905132e7525661a1d4818300b2f62ef88997ee6daaf2b54f7f5e58fcf34
Instruction ID: 949b56546ccaf90be949e229be89ec1215a9c62a6db10ba406891ceaffc337b1
Opcode Fuzzy Hash: 92d92905132e7525661a1d4818300b2f62ef88997ee6daaf2b54f7f5e58fcf34
Instruction Fuzzy Hash: D7B2F470C00288DEDF14DFA4C9587EEBBB4AF15308F1482AEE4457B2D2D7785A89CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00442940 Relevance: 218.3, APIs: 40, Strings: 83, Instructions: 3075fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 00442C53
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442CAF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004434EF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443639
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 004436EF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0044383A
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 004438D6
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443A09
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443AA4
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443BFE
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443C97
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443ED8
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444039
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00444292
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,00000000), ref: 00444416
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0044483E
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444898
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444A1E
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444CE4
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00444E4E
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444B76

Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B24F
Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B260

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00445C65
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00445CC0
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0044337F

Part of subcall function 0040E7B0: FindFirstFileA.KERNEL32(00000000,7F7A790F,?,7F7A790E,00445E27,00000000,7F7A790E,7F7A790F,74DF3100,?), ref: 0040E929

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442CE0

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442E08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442E37
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00442F2F
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443029
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443087
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004431B8
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0044324A

Strings

7;x, xrefs: 00444E9A
0>?, xrefs: 00444374
9:, xrefs: 00444EB0
9"6-, xrefs: 0044596A
)u$0, xrefs: 00445974
6:, xrefs: 00442C7A
%26>, xrefs: 004447EF
4>(, xrefs: 00443C5A
3$, xrefs: 00442FEB
";=w, xrefs: 00443C50
ghi, xrefs: 00444B90
3y<8, xrefs: 00443168
759*, xrefs: 004451E3
4(r), xrefs: 0044452A
9"6-, xrefs: 004439B5
0(33, xrefs: 00445369
)u6., xrefs: 004439BF
315, xrefs: 00442CF2
.4.<, xrefs: 00444EA6
"83<, xrefs: 00444520
.4.<, xrefs: 00444E0C
!'14;y=!?, xrefs: 004429C4, 004429ED
;26-, xrefs: 004449D9
+, xrefs: 00445E83
.4.<, xrefs: 00444DAA
9"6-, xrefs: 004459DE
! 2;, xrefs: 0044420F, 00444212
3>2), xrefs: 00443A65
759*, xrefs: 00445271
"?=+, xrefs: 0044388C
t224, xrefs: 00442EE6
1,), xrefs: 00442EDC
2, xrefs: 004459F2
315, xrefs: 00442C70
#9;1, xrefs: 004436AF
0(33, xrefs: 004452EE
4>(, xrefs: 00443CBF
*, xrefs: 00443BB8
34*8, xrefs: 0044320A
7;x, xrefs: 00444DA0
k, xrefs: 00444B9A
9"6-, xrefs: 00445A3C
11, xrefs: 004439C9
|76, xrefs: 00445641
)u$0, xrefs: 004459E8
0+, xrefs: 004438A0
w Y_[], xrefs: 004445DC, 004445E2
0>?w, xrefs: 0044535F
?), xrefs: 004436B9
?0, xrefs: 00443E49
61, xrefs: 00443E15
7:, xrefs: 00443FFD
!#7), xrefs: 00443047
%1, xrefs: 0044455F
&2, xrefs: 0044485C
)u(%, xrefs: 00443BAE
2, xrefs: 0044597E
$'4<, xrefs: 0044585E
., xrefs: 00443172
1<:3, xrefs: 00443E3F
</, xrefs: 00443214
9:, xrefs: 00444E16
7;x, xrefs: 00444E02
|::<, xrefs: 0044562A, 0044562D
?(, xrefs: 004451ED
_, xrefs: 00444676
1>6, xrefs: 00445807
759*, xrefs: 0044518B
?(, xrefs: 0044527D
9:, xrefs: 00444DB4
0>?w, xrefs: 004452E4
?)/, xrefs: 004447F9
9"6-, xrefs: 00443BA4
&+, xrefs: 00444534
864, xrefs: 00444D02
3:, xrefs: 00443051
0>?, xrefs: 004443CF
";=w, xrefs: 00443CB5
6:, xrefs: 00442CFC
864, xrefs: 00444CA1
?(, xrefs: 00445195
0>?, xrefs: 00444477
|';-, xrefs: 004455FF, 00445602

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateDirectory$File$Copy$Cpp_errorFolderPathThrow_std::_$AttributesErrorFindFirstLast
String ID: 1,)$ghi$! 2;$!#7)$!'14;y=!?$"83<$";=w$";=w$"?=+$#9;1$$'4<$%1$%26>$&+$&2$)u$0$)u$0$)u(%$)u6.$*$+$.$.4.<$.4.<$.4.<$0(33$0(33$0+$0>?$0>?$0>?$0>?w$0>?w$11$1<:3$1>6$2$2$315$315$3$$34*8$3:$3>2)$3y<8$4(r)$4>($4>($61$6:$6:$759*$759*$759*$7:$7;x$7;x$7;x$864$864$9"6-$9"6-$9"6-$9"6-$9"6-$9:$9:$9:$;26-$</$?($?($?($?)$?)/$?0$_$k$t224$w Y_[]$|';-$|76$|::<
API String ID: 2574188035-1442773133
Opcode ID: e0e9df481a5505c13180842b4de196b9cbc88ea6b0bb66655e264c48779144b7
Instruction ID: 381145703412e6fb88b60a60e01735f5d7b95eb576607faa1d3520efd2827bc4
Opcode Fuzzy Hash: e0e9df481a5505c13180842b4de196b9cbc88ea6b0bb66655e264c48779144b7
Instruction Fuzzy Hash: 56639E70C04298DADB21EB65CD557DEBBB4AF21308F4441DAD449772C2EBB81B88CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0045EA9C Relevance: 200.4, APIs: 39, Strings: 74, Instructions: 2609threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000), ref: 0045EB04
GetLastError.KERNEL32 ref: 0045EB19
Sleep.KERNEL32(00000529), ref: 0045EB3A
Sleep.KERNEL32(0000002F), ref: 0045EBAA
shutdown.WS2_32(00000002), ref: 0045EBDA
closesocket.WS2_32 ref: 0045EBE6
WSACleanup.WS2_32 ref: 0045EBEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045ECA1
Sleep.KERNELBASE(00000065), ref: 0045EE48
Sleep.KERNEL32(00000000,?,?), ref: 0045EEFF
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 0045F20A
GetProcAddress.KERNEL32(00000000,00000000), ref: 0045F212
GetCurrentProcess.KERNEL32(00000000), ref: 0045F220
OutputDebugStringA.KERNELBASE(#@#^@#TGRERTERYERY,?,?,00000018,0000000A,Function_00002990,00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045F234
OutputDebugStringA.KERNELBASE(ewetwertyer eytdryrtdy,00000000,00000000), ref: 0045F2F5
OutputDebugStringA.KERNEL32(td ydrthrhfty,00000000), ref: 0045F4D0
OutputDebugStringA.KERNELBASE(45 hgfch rtdyt gfch,0051D9CA,?,?), ref: 0045FEA5
CreateThread.KERNELBASE(00000000,00000000,00450430,00000000,00000000,00000000), ref: 0045FED0
CreateThread.KERNELBASE(00000000,00000000,00455FC0,00000000,00000000,00000000), ref: 0045FEE6
WaitForSingleObject.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,0051DAE8,00000001,?,?), ref: 0046008D
CreateThread.KERNELBASE(00000000,00000000,Function_000564A0,00000000,00000000,00000000), ref: 00460280
CreateThread.KERNELBASE(00000000,00000000,Function_00058520,00000000,00000000,00000000), ref: 00460294
CreateThread.KERNELBASE(00000000,00000000,Function_0005A490,00000000,00000000,00000000), ref: 004602AB
CreateThread.KERNELBASE(00000000,00000000,Function_0005B4B0,00000000,00000000,00000000), ref: 004602C2
CreateThread.KERNELBASE(00000000,00000000,Function_0005CAE0,00000000,00000000,00000000), ref: 004602D9
CreateThread.KERNELBASE(00000000,00000000,Function_0005CC40,00000000,00000000,00000000), ref: 004602ED
CreateThread.KERNELBASE(00000000,00000000,Function_0005D7B0,00000000,00000000,00000000), ref: 00460301
WaitForSingleObject.KERNEL32(?,000493E0), ref: 004604BE
WaitForSingleObject.KERNEL32(?,000493E0), ref: 0046056B
OutputDebugStringA.KERNELBASE( drthdrthdrthdr hrtd hr,0051D9CA,?,?), ref: 00460FAA
CloseHandle.KERNEL32(?), ref: 004607EF

Part of subcall function 00462D20: Concurrency::cancel_current_task.LIBCPMT ref: 00463084

CreateMutexA.KERNEL32(00000000,00000001,00000000), ref: 004610D8
GetLastError.KERNEL32 ref: 004610ED
Sleep.KERNEL32(00007530), ref: 00461109
Sleep.KERNEL32(00000064), ref: 00461174
Sleep.KERNELBASE(00000BB8,?,?), ref: 004611A9
shutdown.WS2_32(00000002), ref: 004611B3
closesocket.WS2_32 ref: 004611BF
Sleep.KERNEL32(000003E8,?,?), ref: 004611D7

Strings

1, xrefs: 00460F6B
n1&k, xrefs: 0045FA44, 0045FA47
>!6:, xrefs: 0045F521
$28 3, xrefs: 0045F9CB, 0045F9D3
45 hgfch rtdyt gfch, xrefs: 0045FEA0
>00, xrefs: 0045F3CA
5!57, xrefs: 0045F4D8
hhCT, xrefs: 00461024
jjj, xrefs: 0045FED2
5!57, xrefs: 0045F2FD
><3<, xrefs: 0045FF0F
<290, xrefs: 0045FBBE, 0045FBC6
., xrefs: 0045ED09
5!57, xrefs: 0045F45A
!?=6, xrefs: 00461085
!?=6, xrefs: 0045EAB1
$;+, xrefs: 0045F2B9
[7, xrefs: 0045F240
4, xrefs: 00460E3C
$28 3, xrefs: 0045FC6E, 0045FC76
5!57, xrefs: 0045F377
ntdll.dll, xrefs: 0045F203
$28 3, xrefs: 0045F728, 0045F730
$;+, xrefs: 0045F26F
x345, xrefs: 0046111E
)/3/, xrefs: 0045F3D4
n1&k, xrefs: 0045FCE4, 0045FCE7
_Y, xrefs: 0045F7D3
1,), xrefs: 0045F41A
:, xrefs: 004610A3
|)=%, xrefs: 00460A63
5!57, xrefs: 0045F410
0w, xrefs: 0045F63B
x345, xrefs: 0045EB54
n1&k, xrefs: 0045FAD6, 0045FAEC
><3<8$, xrefs: 0045FFC6, 0045FFCE
_Y, xrefs: 0045FA74
S2, xrefs: 0045F618
<290, xrefs: 0045F67B, 0045F683
8$, xrefs: 0045FF19
#?, xrefs: 0045F307
:, xrefs: 0045EACF
95, xrefs: 0045F381
hXCT, xrefs: 00460FF8
hxCT, xrefs: 0046100E
drthdrthdrthdr hrtd hr, xrefs: 00460FA5
5!57, xrefs: 0045F33A
6>(., xrefs: 0045F38B
_Y, xrefs: 0045FD13
|)=%, xrefs: 00460B5E, 00460B6E
#@#^@#TGRERTERYERY, xrefs: 0045F22F
PnE, xrefs: 0046105C
5!57, xrefs: 0045F3C0
3+, xrefs: 0045F344
', xrefs: 0045F3DE
jjj, xrefs: 0045FEC1
5!57, xrefs: 0045F2AF
' 1, xrefs: 0045F517
n1&k, xrefs: 0045F835, 0045F84C
h0u, xrefs: 00461104
3f, xrefs: 0045EE78
td ydrthrhfty, xrefs: 0045F4C6
ewetwertyer eytdryrtdy, xrefs: 0045F2EB
n1&k, xrefs: 0045F79E, 0045F7A1
094, xrefs: 0045F464
n1&k, xrefs: 0045FD75, 0045FD8C
<290, xrefs: 0045F91B, 0045F923
?>2, xrefs: 0045F279
?(, xrefs: 0045F46E
?>2, xrefs: 0045F2C3
5!57, xrefs: 0045F265
hHBT, xrefs: 00460FE2
wc, xrefs: 0045EF14
!(7, xrefs: 0045F4E2

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Create$Thread$Sleep$DebugOutputString$ObjectSingleWait$ErrorHandleLastMutexclosesocketshutdown$AddressCleanupCloseConcurrency::cancel_current_taskCurrentModuleProcProcessUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: 95$!(7$#?$$;+$$;+$094$1,)$3+$>00$ drthdrthdrthdr hrtd hr$!?=6$!?=6$#@#^@#TGRERTERYERY$$28 3$$28 3$$28 3$'$' 1$)/3/$.$1$4$45 hgfch rtdyt gfch$5!57$5!57$5!57$5!57$5!57$5!57$5!57$5!57$5!57$6>(.$8$$:$:$<290$<290$<290$>!6:$><3<$><3<8$$?($?>2$?>2$PnE$_Y$_Y$_Y$ewetwertyer eytdryrtdy$h0u$hHBT$hXCT$hhCT$hxCT$jjj$jjj$n1&k$n1&k$n1&k$n1&k$n1&k$n1&k$ntdll.dll$td ydrthrhfty$x345$x345$|)=%$|)=%$0w$3f$S2$[7$wc
API String ID: 2410146291-3778327771
Opcode ID: a646b8ba70172d533d14d870466a7871b9c6d1fc2ec42d0352852053597e7a94
Instruction ID: b7f19cb37b0b56de54bd6a9fc88ff5451383e5df5d0154206795b38d17b259f9
Opcode Fuzzy Hash: a646b8ba70172d533d14d870466a7871b9c6d1fc2ec42d0352852053597e7a94
Instruction Fuzzy Hash: E943CF30900258DBCB25DF68C895BEEBBB0AF15308F1441DAD4456B392EB74AF49CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00446020 Relevance: 139.6, APIs: 13, Strings: 65, Instructions: 3085registryfilecomCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004485E3
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000,?,?), ref: 004486E2
RegCloseKey.ADVAPI32(?,?,?), ref: 0044870C
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00448973
GetUserNameA.ADVAPI32(?,00000104), ref: 004489A9

Part of subcall function 004160B0: GetModuleHandleA.KERNEL32(3B263619,?), ref: 00416186
Part of subcall function 004160B0: GetProcAddress.KERNEL32(00000000,34312111), ref: 00416191
Part of subcall function 004160B0: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004161E1

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020006), ref: 0044865A

Part of subcall function 00415E30: GetFileAttributesA.KERNELBASE(?,7FFFFFFF), ref: 00415EDC

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004490D9
SHGetFolderPathA.SHELL32(00000000,00000007,00000000,00000000,?), ref: 004490F6
CoInitialize.OLE32(00000000), ref: 004491DD
CoCreateInstance.OLE32(Function_00115570,00000000,00000001,Function_00115540,?), ref: 004491FD
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 00449289
CoUninitialize.OLE32 ref: 004492B9
ShellExecuteA.SHELL32(00000000,=#1;,00000000,00000000,00000000,00000001), ref: 00449327

Strings

?), xrefs: 004483AA
6<94?9, xrefs: 00446C57, 00446C5F
~, xrefs: 00446869
'!8, xrefs: 004474BA
'!8, xrefs: 0044780A
'!8, xrefs: 004477DE
ps{!, xrefs: 00448C98
? =, xrefs: 00447BA8
38, xrefs: 004461ED
:' %%mwv, xrefs: 0044822D, 00448233
"=3, xrefs: 00447D1C
~, xrefs: 004462F2
I5=I, xrefs: 00448CE7
6<7, xrefs: 00447C86
7%3*, xrefs: 0044615F
6<94?9, xrefs: 00446FF9, 00447001
4:18, xrefs: 004461AB
&+ , xrefs: 00447C3C
8wz, xrefs: 00448C76
".?9, xrefs: 00448C2A
8#12, xrefs: 00447DB3
~, xrefs: 004465B0
ps{!, xrefs: 00448A1A
r, xrefs: 00446574
;/9/, xrefs: 00448318
$1', xrefs: 00447E98
$wz, xrefs: 00448CA2
|6,0, xrefs: 00449000
8#3, xrefs: 00447D66
!0&, xrefs: 00447BF2
~, xrefs: 00446685
|?:>, xrefs: 00449120
|, xrefs: 0044809E
6<94?9, xrefs: 00446FC7, 00446FCF
F/!., xrefs: 00448C20
6<7-, xrefs: 00447CD0
#>4=, xrefs: 004461A1
7+1, xrefs: 00447B32
02 , xrefs: 00447E4F
|6,0, xrefs: 00448506
$wz, xrefs: 00448A4D
0>$, xrefs: 00447E02
~, xrefs: 00446955
=#1;, xrefs: 0044931E, 00449324
, xrefs: 0044941F
7+1, xrefs: 00448079
7:=, xrefs: 0044611F
&39-, xrefs: 004483A0
|6,0, xrefs: 00447A4B, 00447A5D
'!8, xrefs: 004474E3
|6,0, xrefs: 00448896
6<94?9, xrefs: 00446C89, 00446C91
|, xrefs: 0044701A
?2&>374;22., xrefs: 00446842, 00446848
r, xrefs: 004464B8
H, xrefs: 00448CEE
ps{!, xrefs: 00448A43
|, xrefs: 00447A71
ps{!, xrefs: 00448C6C
'!8, xrefs: 0044727A
|, xrefs: 00446CAA
8wz, xrefs: 00448A24
'!8, xrefs: 004472A6
?2&>47,4/.4;,, xrefs: 00446921, 00446927
$;, xrefs: 00446226

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$Copy$AttributesCreate$AddressByteCharCloseErrorExecuteFolderHandleInitializeInstanceLastModuleMultiNameOpenPathProcProcessShellUninitializeUserValueWide
String ID: $!0&$".?9$"=3$#>4=$$1'$$;$$wz$$wz$&+ $&39-$'!8$'!8$'!8$'!8$'!8$'!8$02 $0>$$38$4:18$6<7$6<7-$6<94?9$6<94?9$6<94?9$6<94?9$7%3*$7+1$7+1$7:=$8#12$8#3$8wz$8wz$:' %%mwv$;/9/$=#1;$? =$?)$?2&>374;22.$?2&>47,4/.4;,$F/!.$H$I5=I$ps{!$ps{!$ps{!$ps{!$r$r$|$|$|$|$|6,0$|6,0$|6,0$|6,0$|?:>$~$~$~$~$~
API String ID: 28878968-3024362790
Opcode ID: 53ee7943a4d10e95177547a8ef1a0f72a36595a407d00afbd4f2d34883170685
Instruction ID: 429461b7d5384cafcc2df35996eafbcc51918cc99cf467c7d99fa79c194b986d
Opcode Fuzzy Hash: 53ee7943a4d10e95177547a8ef1a0f72a36595a407d00afbd4f2d34883170685
Instruction Fuzzy Hash: C863AA70D042989ADB25EB64CD55BDEBBB4AF11308F0041DAE449772D2EB781F88CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00434B20 Relevance: 109.6, APIs: 6, Strings: 55, Instructions: 2842stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00434C41
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00434CE6
GetPrivateProfileStringA.KERNEL32(?,3D203202,00000000,?,00000104,?), ref: 00434DB6
lstrlenA.KERNEL32(?), ref: 00437778

Part of subcall function 0040AB40: __fread_nolock.LIBCMT ref: 0040AC3C

CreateDirectoryA.KERNEL32(?,00000000,?,3421020E,?,00000000,3421020E,3421020F,?,?,><3<8$,><3<8$,00000000), ref: 00436806
CreateDirectoryA.KERNEL32(?,00000000), ref: 00436B77

Strings

8#-4, xrefs: 00436744
8, xrefs: 00437106
"2'&!8*=, xrefs: 0043654B, 0043657F
%1, xrefs: 00437170
16&!oy<;, xrefs: 004375A6, 004375CF
ey<;, xrefs: 00436B91
ey<;, xrefs: 00436C1E
"ov=, xrefs: 0043719E
by<;, xrefs: 00436E3F
8, xrefs: 004373EC
8, xrefs: 004375F2
><3<8$, xrefs: 00435B41, 00435B4E
"!;3?;=, xrefs: 00435421, 00435454
'!8, xrefs: 00436155, 00436182
4<&8, xrefs: 00435F47
?;=, xrefs: 00434D0C
_, xrefs: 0043693E
16&!ny<;, xrefs: 004372C7, 004372F0
><3<8, xrefs: 004356B7, 004356E4
"nv=, xrefs: 0043747E
><3<8$, xrefs: 00435B91, 00435B9E
%1, xrefs: 00436EA2
><3<8$, xrefs: 00434BBE, 00434BC5
"2'&!8*=, xrefs: 0043581B, 0043584F
8, xrefs: 00437488
8, xrefs: 00437313
96-fx3:, xrefs: 00436D24, 00436D4C
"nv=, xrefs: 004373E2
"!;3?;=, xrefs: 00435D92, 00435DBF
4<&8, xrefs: 00435EE4
:<'!865<, xrefs: 00436104, 00436111
\, xrefs: 0043694E
*,, xrefs: 00436758
3, xrefs: 00437814
%1, xrefs: 00436BF4
"nv=, xrefs: 004375E8
by<;, xrefs: 00437028
8, xrefs: 004371A8
0>4<, xrefs: 00434C6C
ey<;, xrefs: 00436D65
'!8, xrefs: 00435FDC, 0043600C
96-ax3:, xrefs: 00436FE6, 0043700F
cannot use operator[] with a string argument with , xrefs: 00437803, 0043785D
by<;, xrefs: 00436ECE
?9+w, xrefs: 00434E61
><3<8$, xrefs: 00436696, 0043669C
1, xrefs: 00434EA5
><3<8$, xrefs: 00435958, 0043595E
4<&8, xrefs: 00435E81
\, xrefs: 00434DBC
%1, xrefs: 00437450
"ov=, xrefs: 00437309
"ov=, xrefs: 004370FC
0(33, xrefs: 00434E68
'!8, xrefs: 00435565, 00435592

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateDirectoryPrivateProfile$FolderNamesPathSectionString__fread_nolocklstrlen
String ID: 1$"!;3?;=$"!;3?;=$"2'&!8*=$"2'&!8*=$"nv=$"nv=$"nv=$"ov=$"ov=$"ov=$%1$%1$%1$%1$'!8$'!8$'!8$*,$0(33$0>4<$16&!ny<;$16&!oy<;$3$4<&8$4<&8$4<&8$8$8$8$8$8$8$8#-4$96-ax3:$96-fx3:$:<'!865<$><3<8$><3<8$$><3<8$$><3<8$$><3<8$$><3<8$$?9+w$?;=$\$\$_$by<;$by<;$by<;$cannot use operator[] with a string argument with $ey<;$ey<;$ey<;
API String ID: 2628882823-1854249681
Opcode ID: bbd6992d621bea28f56fe6e48aca4a1b53f3561d189d7dca3e6bafde97b9e786
Instruction ID: a36599697f4023ba1647c38f0aef950e154c638e9f7ae6bdb9cf337964260f01
Opcode Fuzzy Hash: bbd6992d621bea28f56fe6e48aca4a1b53f3561d189d7dca3e6bafde97b9e786
Instruction Fuzzy Hash: 0F53CF70C042989EDF25DB64CC48BEEBBB4AF16308F1441DED44967282EB785B89CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00458520 Relevance: 106.7, APIs: 3, Strings: 57, Instructions: 1711COMMON

Download Yara Rule

APIs

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

Part of subcall function 0040B270: CreateDirectoryA.KERNELBASE(?,00000000,00000005,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B2B5

Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B24F
Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B260

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00459B2F
CreateDirectoryA.KERNEL32(?,00000000,00000000,?), ref: 00459CDC
CreateDirectoryA.KERNEL32(?,00000000,00000000,?), ref: 00459DA2

Strings

|',!, xrefs: 00458949
=>=*, xrefs: 004588F3
), xrefs: 00458626
6<94?9, xrefs: 00458BA0
$6,0, xrefs: 00458C69
!67 $2, xrefs: 00458E2D
"2 =, xrefs: 00458C10
31, xrefs: 00459484
"2 =, xrefs: 00459630
7+$<, xrefs: 0045964F
|',!, xrefs: 00459E16
31, xrefs: 00458A8E
&<?08, xrefs: 0045A080
$6,0, xrefs: 004596A6
$28 3, xrefs: 00458DBF
|',!, xrefs: 00459358
$28 3, xrefs: 004597AF
!$=+, xrefs: 00459AA8
?4=, xrefs: 0045A03F
), xrefs: 00459AAF
*:, xrefs: 00458CCA
w ]p, xrefs: 0045A0FC
<290, xrefs: 00459714
!$=+, xrefs: 0045861C
6<94?9, xrefs: 00459590
:' %, xrefs: 00458EAE
<290, xrefs: 00458D54
*:, xrefs: 0045966D
*:, xrefs: 004596BA
7+$<, xrefs: 00458C5F
!6&#, xrefs: 0045A002
$28 3, xrefs: 00458D8D
7+$<, xrefs: 0045969C
=>=*, xrefs: 004585ED
"2 =, xrefs: 00458C40
6<94?96<94?9, xrefs: 00458BD9
:' %, xrefs: 0045988F
$6,0, xrefs: 00458CB6
<290, xrefs: 00459744
*:, xrefs: 00458C7D
?4=, xrefs: 0045A00C
", xrefs: 0045A333
w Y_, xrefs: 0045A306
$28 3, xrefs: 0045977D
t/$), xrefs: 004588FD
&<?08, xrefs: 0045A0A6
<290, xrefs: 00458D24
6<94?96<94?9, xrefs: 004595C9
t/$), xrefs: 0045930C
31, xrefs: 00459F5B
%1, xrefs: 0045A23F
=>=*, xrefs: 00459302
7+$<, xrefs: 00458CAC
!6&#, xrefs: 0045A035
!67 $2, xrefs: 00459811
"2 =, xrefs: 00459600
$6,0, xrefs: 00459659

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID: !$=+$!$=+$!6&#$!6&#$!67 $2$!67 $2$"$"2 =$"2 =$"2 =$"2 =$$28 3$$28 3$$28 3$$28 3$$6,0$$6,0$$6,0$$6,0$%1$&<?08$&<?08$)$)$*:$*:$*:$*:$31$31$31$6<94?9$6<94?9$6<94?96<94?9$6<94?96<94?9$7+$<$7+$<$7+$<$7+$<$:' %$:' %$<290$<290$<290$<290$=>=*$=>=*$=>=*$?4=$?4=$t/$)$t/$)$w Y_$w ]p$|',!$|',!$|',!
API String ID: 453214671-2294095452
Opcode ID: 7ffdaf4037cb2d030a63199d217c015197ae860a8e502b6e60a93467012496ea
Instruction ID: 57ae14f2feaf59c3a95a653b4d20b0d10ef2dfc7cc1885f066834b7badb08a9e
Opcode Fuzzy Hash: 7ffdaf4037cb2d030a63199d217c015197ae860a8e502b6e60a93467012496ea
Instruction Fuzzy Hash: 70036B70904298DEDB25EB65C9597DEBBB4AF11308F0400DED44977292EBB81F88CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00428180 Relevance: 94.4, APIs: 2, Strings: 50, Instructions: 3351COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,3E3B3C31), ref: 004282B4

Part of subcall function 0040AB40: __fread_nolock.LIBCMT ref: 0040AC3C

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042A957

Part of subcall function 004DE42B: RaiseException.KERNEL32(E06D7363,00000001,00000003,0045DCD0,0045DCD0,?,?,004DAF37,0045DCD0,0053D744,00000000,0045DCD0,00000000,00000001), ref: 004DE48B

Strings

"2 =, xrefs: 0042A471, 0042A47E
!67 $2, xrefs: 0042A71F, 0042A74F
$.(-, xrefs: 0042969F
\, xrefs: 00429BAE
$.(-, xrefs: 00428C02
/',<, xrefs: 00428D37
!8*2, xrefs: 004284D3
*:, xrefs: 0042A9AD
$bd, xrefs: 0042AD2E
$6,0, xrefs: 0042A999
:' %, xrefs: 0042A264
\, xrefs: 00429428
$be, xrefs: 0042AD63
7=7', xrefs: 0042978C
', xrefs: 004297AC
\, xrefs: 004291F6
1<;>?2+, xrefs: 00428221
', xrefs: 00428CA3
\, xrefs: 0042892A
1<;>, xrefs: 0042B3E7
7=7', xrefs: 004296DE
\, xrefs: 00428AAD
\, xrefs: 00429C2D
', xrefs: 00428D4D
\, xrefs: 00428EF4
/',<, xrefs: 00428C8D
7+$<, xrefs: 0042A98F
$.(-, xrefs: 00429646
#;,, xrefs: 0042B262
/',<, xrefs: 00429796
$.(-, xrefs: 00428CEE
$28 3, xrefs: 0042AED9, 0042AEFC
cannot use operator[] with a string argument with , xrefs: 0042B53A, 0042B58C, 0042B5DE, 0042B630
7=7', xrefs: 00428C83
[, xrefs: 0042B641
7=7', xrefs: 00428D2D
\, xrefs: 004293AC
1, xrefs: 0042A4D9
\, xrefs: 00428F6A
?2+, xrefs: 0042B3F0
1, xrefs: 0042A099
/',<, xrefs: 004296E8
$28 3, xrefs: 0042B135, 0042B15C
6<94?9, xrefs: 0042A031, 0042A03E
$.(-, xrefs: 0042974B
#;,, xrefs: 004299A8
', xrefs: 004296FE
9%3, xrefs: 0042845C
<290, xrefs: 0042AC31, 0042AC3E
\, xrefs: 00428515

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFolderPathRaiseUnothrow_t@std@@@__ehfuncinfo$??2@__fread_nolock
String ID: !67 $2$!8*2$"2 =$#;,$#;,$$.(-$$.(-$$.(-$$.(-$$.(-$$28 3$$28 3$$6,0$$bd$$be$'$'$'$'$*:$/',<$/',<$/',<$/',<$1$1$1<;>$1<;>?2+$6<94?9$7+$<$7=7'$7=7'$7=7'$7=7'$9%3$:' %$<290$?2+$[$\$\$\$\$\$\$\$\$\$\$cannot use operator[] with a string argument with
API String ID: 763711979-1342090246
Opcode ID: f3990dcf742785826510b3bb77b6ceb428905fb40aa7cc0d599a2a9fb42f1cf9
Instruction ID: 75da0da8fc7ec44c57da9840ff1f0e32adef3685c6fae34395cd54ce1a610f13
Opcode Fuzzy Hash: f3990dcf742785826510b3bb77b6ceb428905fb40aa7cc0d599a2a9fb42f1cf9
Instruction Fuzzy Hash: 1A73CD70D002A88BDB25DB68DC547EEBBB0AF15308F5441DED44967282DB786F88CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004564A0 Relevance: 90.6, Strings: 71, Instructions: 1823COMMON

Download Yara Rule

Strings

?;=*, xrefs: 0045693F
"2'&!8*=, xrefs: 00457DA6
><3<8, xrefs: 00457D36
% 7+, xrefs: 004575FC
w , xrefs: 00457690
"!;3, xrefs: 00457098
?;=, xrefs: 004570A2
"2'&!8*=, xrefs: 00457905
'!8, xrefs: 00456666
w w , xrefs: 00458332
"!;3, xrefs: 00457E44
'!8, xrefs: 00456F35
'!8, xrefs: 00457CB7
%1, xrefs: 00458037
?;=, xrefs: 004567C7
'!8, xrefs: 00457CE6
"2'&!8*=, xrefs: 00456798
>(r), xrefs: 00456AC2
58*=, xrefs: 00458057
31, xrefs: 00456BA7
), xrefs: 00456516
% 7+, xrefs: 004572A1
'!8, xrefs: 00456689
`a, xrefs: 004583AA
?;=, xrefs: 00457E4E
'!8, xrefs: 00456F64
><3<8, xrefs: 00457D65
&+, xrefs: 004572AF
?;=, xrefs: 00457E15
t/$), xrefs: 00458061
?;=, xrefs: 00457974
&+, xrefs: 00456ACC
w %1, xrefs: 00457360
!$=+, xrefs: 0045650C
%1, xrefs: 00457314
'!8, xrefs: 00457836
>(r), xrefs: 004572A8
"2'&!8*=, xrefs: 00457DE6
%1w , xrefs: 00458254
i, xrefs: 00457B3D
?;=, xrefs: 00456800
%1, xrefs: 004575DF
><3<8, xrefs: 00456FB4
><3<8, xrefs: 00456FEC
><3<8, xrefs: 00456711
"2'&!8*=, xrefs: 00456758
&+, xrefs: 0045760A
"2'&!8*=, xrefs: 00457073
%1, xrefs: 00456B3B
;615, xrefs: 00458266
"!;3, xrefs: 004570D1
"2'&!8*=, xrefs: 00457033
?;=, xrefs: 004570DB
% 7+, xrefs: 00456AB8
><3<8, xrefs: 00457886
31, xrefs: 00457378
"!;3, xrefs: 0045796A
"!;3, xrefs: 004567F6
"!;3, xrefs: 004567BD
><3<8, xrefs: 004566D9
w , xrefs: 00458306
u, xrefs: 00456949
'!8, xrefs: 00457807
"2'&!8*=, xrefs: 00457945
"!;3, xrefs: 00457E0B
><3<8, xrefs: 004578BE
"!;3, xrefs: 004579A3
t/$), xrefs: 00458270
?;=, xrefs: 004579AD
w %1, xrefs: 00456B8F
>(r), xrefs: 00457603

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$AttributesCreateDirectoryErrorFileLast
String ID: !$=+$"!;3$"!;3$"!;3$"!;3$"!;3$"!;3$"!;3$"!;3$"2'&!8*=$"2'&!8*=$"2'&!8*=$"2'&!8*=$"2'&!8*=$"2'&!8*=$"2'&!8*=$"2'&!8*=$% 7+$% 7+$% 7+$%1$%1$%1$%1$%1w $&+$&+$&+$'!8$'!8$'!8$'!8$'!8$'!8$'!8$'!8$)$31$31$58*=$;615$>(r)$>(r)$>(r)$><3<8$><3<8$><3<8$><3<8$><3<8$><3<8$><3<8$><3<8$?;=$?;=$?;=$?;=$?;=$?;=$?;=$?;=$?;=*$`a$i$t/$)$t/$)$u$w $w $w %1$w %1$w w
API String ID: 325604351-255260331
Opcode ID: 7dcd8d6871f77b4598944d0541f840cbd14ff571c96704b36630e61251187c15
Instruction ID: b3a347ab2d5913c55b79dc2b7675eac22e4de48785ab9d64140a0416f3fdeda6
Opcode Fuzzy Hash: 7dcd8d6871f77b4598944d0541f840cbd14ff571c96704b36630e61251187c15
Instruction Fuzzy Hash: FB137B30C04298DADB21EBA5CD557DDBBB4AF21308F4441EED44977292EBB81F88CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00424730 Relevance: 86.0, APIs: 1, Strings: 46, Instructions: 3763COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,12&1%,?,?,?,00000004), ref: 0042487A

Strings

7=7', xrefs: 004251C8
7+$/29+, xrefs: 004279C1, 004279CE
\, xrefs: 004258C5
12&1%, xrefs: 004247E1, 004247EE
\, xrefs: 00425412
\, xrefs: 00425849
/',<, xrefs: 00425133
$.(-, xrefs: 00425ADB
<:7>865<, xrefs: 00427CC3, 00427CD0
\, xrefs: 00424E04
\, xrefs: 00424F7A
$be, xrefs: 00426819
9:.9, xrefs: 00427699
#;,, xrefs: 00427336
/',<, xrefs: 00425C26
\, xrefs: 00425696
$.(-, xrefs: 00425198
\, xrefs: 00425FF7
#;,, xrefs: 00425E39
$.(-, xrefs: 00425BDB
cannot use operator[] with a string argument with , xrefs: 0042800E, 00428060, 004280B2, 00428104
<:7>865<, xrefs: 0042720A, 00427233
12&1%, xrefs: 00427F27, 00427F2D
>2'!17,(, xrefs: 00427B44, 00427B51
X, xrefs: 00428115
7+$;86-2, xrefs: 00427844, 00427851
$bd, xrefs: 004267E9
/',<, xrefs: 00425B78
', xrefs: 00425149
=!=2?9, xrefs: 00426D5C, 00426D85
\, xrefs: 0042539C
<290, xrefs: 004263D4
#;,, xrefs: 00427D5F
$.(-, xrefs: 00425B2F
<290, xrefs: 00427685
', xrefs: 00425B8E
12&19-48>., xrefs: 00426AFF, 00426B2F
7=7', xrefs: 00425129
\, xrefs: 0042607B
/',<, xrefs: 004251D2
9:.9, xrefs: 004263E8
\, xrefs: 00424A12
', xrefs: 004251E8
7=7', xrefs: 00425B6E
7=7', xrefs: 00425C1C
', xrefs: 00425C3C

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: #;,$#;,$#;,$$.(-$$.(-$$.(-$$.(-$$bd$$be$'$'$'$'$/',<$/',<$/',<$/',<$12&19-48>.$12&1%$12&1%$7+$/29+$7+$;86-2$7=7'$7=7'$7=7'$7=7'$9:.9$9:.9$<290$<290$<:7>865<$<:7>865<$=!=2?9$>2'!17,($X$\$\$\$\$\$\$\$\$\$\$cannot use operator[] with a string argument with
API String ID: 1514166925-1125462606
Opcode ID: a6fbce01a3c6adbb50c7c44534195b820e1dd5735fb065cfa8055a8dc7fe5fb6
Instruction ID: 2f7e4d1e291f3f1cdc620df9df6a1c96b4595230c5c4730e23e565800bfc6c88
Opcode Fuzzy Hash: a6fbce01a3c6adbb50c7c44534195b820e1dd5735fb065cfa8055a8dc7fe5fb6
Instruction Fuzzy Hash: DD83CF70D042A88BDB25DF68D8447EEBBB4AF15308F1441DED44967282DB786F88CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0045E5D4 Relevance: 60.0, APIs: 16, Strings: 18, Instructions: 450
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,0041E220,00000000,00000000,00000000), ref: 0045E684
CloseHandle.KERNEL32(00000000), ref: 0045E68B
Sleep.KERNELBASE(00000001), ref: 0045E738
GetTempPathA.KERNEL32(000000FB,?,00000000), ref: 0045E78E

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

CreateDirectoryA.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000), ref: 0045E927
CreateDirectoryA.KERNELBASE(00000000,00000000,?,00000000), ref: 0045E953
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045E96A

Strings

37;7, xrefs: 0045E7AE
x345, xrefs: 0046111E
hhCT, xrefs: 00461024
hXCT, xrefs: 00460FF8
h0u, xrefs: 00461104
hxCT, xrefs: 0046100E
jjj, xrefs: 0045E675
drthdrthdrthdr hrtd hr, xrefs: 00460FA5
:, xrefs: 004610A3
?, xrefs: 0045E856
h, xrefs: 0045E5D7
!?=6, xrefs: 00461085
hHBT, xrefs: 00460FE2
pi, xrefs: 0045E91B
PnE, xrefs: 0046105C
:6=1, xrefs: 0045E84C
>i, xrefs: 0045E94D
3, xrefs: 0045E7B8

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Create$Directory$AttributesCloseErrorFileHandleLastPathSleepTempThreadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: drthdrthdrthdr hrtd hr$!?=6$3$37;7$:$:6=1$?$PnE$h$h0u$hHBT$hXCT$hhCT$hxCT$jjj$x345$>i$pi
API String ID: 4231318459-2239746989
Opcode ID: 4e8cadf1558bc808eb15c925feb827478044ca38ad77a820c39c18be29cec92c
Instruction ID: 8077588bf94c0e4bc39e93033f8a776c4edc121c9ce1f6a3b1a7cfd8669552db
Opcode Fuzzy Hash: 4e8cadf1558bc808eb15c925feb827478044ca38ad77a820c39c18be29cec92c
Instruction Fuzzy Hash: D3121470A002488BCB18EF69CC55BDEBB71AF55308F1441DEE9056B2D2EB745F48CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0042C980 Relevance: 59.9, APIs: 1, Strings: 32, Instructions: 2164COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,3E3B2735,?,?,?,00000004), ref: 0042CAB4

Strings

V, xrefs: 0042EB61
7=7', xrefs: 0042DD0E
5';>, xrefs: 0042E95B
\, xrefs: 0042CC34
\, xrefs: 0042E0D2
$.(-, xrefs: 0042DCCF
', xrefs: 0042DD2E
/',<, xrefs: 0042DD18
\, xrefs: 0042E0A2
\, xrefs: 0042D68B
\, xrefs: 0042D0D0
$.(-, xrefs: 0042DD7B
7=7', xrefs: 0042D483
', xrefs: 0042D49A
cannot use operator[] with a string argument with , xrefs: 0042EB50
/',<, xrefs: 0042DDC6
\, xrefs: 0042DAB1
\, xrefs: 0042D24A
$be, xrefs: 0042E5AC
?4=, xrefs: 0042E43F
5';>39+, xrefs: 0042E704
\, xrefs: 0042D8E4
$bd, xrefs: 0042E569
', xrefs: 0042DDDC
&<?08\, xrefs: 0042E742, 0042E76F
39+, xrefs: 0042E964
!6&#, xrefs: 0042E435
7=7', xrefs: 0042DDBC
\, xrefs: 0042D657
\, xrefs: 0042DA7A
$.(-, xrefs: 0042DC7C
/',<, xrefs: 0042D48A

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: !6&#$$.(-$$.(-$$.(-$$bd$$be$&<?08\$'$'$'$/',<$/',<$/',<$39+$5';>$5';>39+$7=7'$7=7'$7=7'$?4=$V$\$\$\$\$\$\$\$\$\$\$cannot use operator[] with a string argument with
API String ID: 1514166925-3834567515
Opcode ID: d683652dda44f9dae4f0f6e733b05dec29e26b7ec3e1f1917560291c9df3a30d
Instruction ID: 533f620bba5b2773b9cbc6b6bd3ac26e45f2e0f23bfd5e739c1d7210883c523b
Opcode Fuzzy Hash: d683652dda44f9dae4f0f6e733b05dec29e26b7ec3e1f1917560291c9df3a30d
Instruction Fuzzy Hash: EB23CF70D002A88BDF25DB68CD547EEBBB0AF15304F1442DEE44967282DBB85B89CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0043EAEB Relevance: 55.2, APIs: 9, Strings: 22, Instructions: 951
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(?,?), ref: 0043ED7A
FindNextFileA.KERNEL32(00000000,?), ref: 0043F019
FindClose.KERNEL32(00000000), ref: 0043F029
CreateDirectoryA.KERNEL32(?,00000000,?,3931070E,?,?,3931070E,3931070F), ref: 0043F0F3
CreateDirectoryA.KERNEL32(?,00000000,?,3430270E,?,?,3430270E,3430270F), ref: 0043F198
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0043F25B

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

CreateDirectoryA.KERNEL32(?,00000000), ref: 0043F3A8
CopyFileA.KERNEL32(00000000,?,00000000), ref: 0043F50E
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0043F75F

Strings

"6, xrefs: 0043EB5F
s, xrefs: 0043F69D
., xrefs: 0043ED90
7, xrefs: 0043F06B
30*8, xrefs: 0043F064
%, xrefs: 0043F44C
\, xrefs: 0043F58C
\, xrefs: 0043EDEA
;(, xrefs: 0043F211
39-, xrefs: 0043EC1E
39-, xrefs: 0043F20A
"6, xrefs: 0043F106
s, xrefs: 0043F573
%, xrefs: 0043F3B7
%, xrefs: 0043EDCE
\, xrefs: 0043F471
;(, xrefs: 0043EC28
\, xrefs: 0043F2E2
1, xrefs: 0043F641
, xrefs: 0043EEB5
\, xrefs: 0043F6A7
1, xrefs: 0043EDAA

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CopyCreateDirectoryFind$AttributesCloseErrorFirstLastNext
String ID: 39-$39-$ $ 1$ 1$"6$"6$%$%$%$.$30*8$7$;($;($\$\$\$\$\$s$s
API String ID: 2727793958-3925946799
Opcode ID: 96eda1e606b0396eca85da87c18276847d1db5a3f05590dd0ceb551169dca9ed
Instruction ID: ff9879098513eefe7118d1867748fd0ca27ef1486d3eeb152b38f87866c2ba9f
Opcode Fuzzy Hash: 96eda1e606b0396eca85da87c18276847d1db5a3f05590dd0ceb551169dca9ed
Instruction Fuzzy Hash: 2E92DF70C00259CFDF28DBA4C948BEEBBB4AF15308F1042EDD44967292EB785A49DF65

Uniqueness

Uniqueness Score: -1.00%

Function 0045B4B0 Relevance: 46.2, Strings: 36, Instructions: 1224COMMON

Download Yara Rule

Strings

<290, xrefs: 0045C22C
), xrefs: 0045BC39
9:.9, xrefs: 0045C281
w ]p:;-TP, xrefs: 0045BB25
'!8, xrefs: 0045BA53
), xrefs: 0045B506
!$=+, xrefs: 0045BC2F
>2'!17,(, xrefs: 0045C359
12&1, xrefs: 0045C2EC
8>., xrefs: 0045C300
7+$/29+, xrefs: 0045C5E7
7+$;86-2, xrefs: 0045C5A6
|',!, xrefs: 0045B85E
7+$;86-2, xrefs: 0045C56A
|',!, xrefs: 0045BF8D
<290, xrefs: 0045C270
'!8, xrefs: 0045BA33
<:7>865<, xrefs: 0045C1D3
t/$), xrefs: 0045B812
7+$/29+, xrefs: 0045C621
9-4, xrefs: 0045C2F6
&:90, xrefs: 0045BAC2
%1, xrefs: 0045B98A
8>., xrefs: 0045C2C3
&:90, xrefs: 0045BA92
!$=+, xrefs: 0045B4FC
"8* , xrefs: 0045B808
12&1, xrefs: 0045C2AF
9-4, xrefs: 0045C2B9
9:.9, xrefs: 0045C240
"/,, xrefs: 0045BF51
>2'!17,(, xrefs: 0045C399
, xrefs: 0045C874
"8* , xrefs: 0045B52A
<:7>865<, xrefs: 0045C20D
%1, xrefs: 0045C0B6

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AttributesCreateDirectoryErrorFileLast
String ID: 9-4$9-4$ $!$=+$!$=+$"/,$"8* $"8* $%1$%1$&:90$&:90$'!8$'!8$)$)$12&1$12&1$7+$/29+$7+$/29+$7+$;86-2$7+$;86-2$8>.$8>.$9:.9$9:.9$<290$<290$<:7>865<$<:7>865<$>2'!17,($>2'!17,($t/$)$w ]p:;-TP$|',!$|',!
API String ID: 674977465-2093587463
Opcode ID: 3891185e4cd8f330b12e7872c9c530ffc4cc23191e2ee05e32caef61de063f78
Instruction ID: f1ec3ed8df4f27eeeafdc384d20f3ca36f04232fc952ab87f7a7b0810dcce7f9
Opcode Fuzzy Hash: 3891185e4cd8f330b12e7872c9c530ffc4cc23191e2ee05e32caef61de063f78
Instruction Fuzzy Hash: DAC29E708042989EDB25EB65CC557DEBBB4AF11308F0401DED44977292EBB81F88DF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0043B65D Relevance: 42.1, APIs: 2, Strings: 21, Instructions: 1862COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,3D203202,00000000,?,00000104,?), ref: 00439D16

Strings

7+$<, xrefs: 0043AF38
@, xrefs: 0043B44A
6<94?9, xrefs: 0043A3DB, 0043A40C
!67 $2, xrefs: 0043AC95, 0043ACC2
"2 =, xrefs: 0043A995, 0043A9C2
<290, xrefs: 0043B185, 0043B1B2
?2+, xrefs: 0043B575
1, xrefs: 0043A079
1, xrefs: 0043AAA1
1, xrefs: 0043A4EA
TbE, xrefs: 0043B685
*:, xrefs: 0043AF56
\, xrefs: 00439D1C
$28 3, xrefs: 0043B39B, 0043B3CC
\, xrefs: 00439F61
$6,0, xrefs: 0043AF42
/, xrefs: 00439E4C
:' %, xrefs: 0043A6B0
1<;>, xrefs: 0043B569
cannot use operator[] with a string argument with , xrefs: 0043B6BE, 0043B6FA
?;=, xrefs: 00439C70

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: PrivateProfileString
String ID: 1$!67 $2$"2 =$$28 3$$6,0$*:$/$1$1$1<;>$6<94?9$7+$<$:' %$<290$?2+$?;=$@$TbE$\$\$cannot use operator[] with a string argument with
API String ID: 1096422788-1476001284
Opcode ID: b6326a3d966fe047580aaad9357315654acdd1c05d44b97173da037dbd77bc33
Instruction ID: e6264ca87e19b7cc07875635de15bcfee6b67c28ad1294dbb86b2ba5eb7e06b0
Opcode Fuzzy Hash: b6326a3d966fe047580aaad9357315654acdd1c05d44b97173da037dbd77bc33
Instruction Fuzzy Hash: AD03D170D002599BDB25DB24C948BEEBBB0AF19308F1441DED48967382D778AF85CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00438770 Relevance: 41.5, APIs: 4, Strings: 19, Instructions: 1262stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?), ref: 004388A3
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00438947
GetPrivateProfileStringA.KERNEL32(?,3D203202,00000000,?,00000104,?), ref: 004389F9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439984

Part of subcall function 004DE42B: RaiseException.KERNEL32(E06D7363,00000001,00000003,0045DCD0,0045DCD0,?,?,004DAF37,0045DCD0,0053D744,00000000,0045DCD0,00000000,00000001), ref: 004DE48B

Strings

52+w, xrefs: 00438D09
*:, xrefs: 00438D17
?;=, xrefs: 00438969
'!8, xrefs: 004395BC
)u53, xrefs: 004388D5
\, xrefs: 004389FF
)*04, xrefs: 00438D10
4:80lxwv, xrefs: 004394AE
7, xrefs: 004388DC
0>4<, xrefs: 004388CE
"2 =, xrefs: 004396BF, 004396C6
1, xrefs: 00438D4F
), xrefs: 004390B6
/, xrefs: 00438B26
Z, xrefs: 0043912D
\, xrefs: 00438C3B
cannot use operator[] with a string argument with , xrefs: 00439A06
#, xrefs: 004396D4
4:80lxwv, xrefs: 00439444, 00439469

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: PrivateProfile$ExceptionFolderNamesPathRaiseSectionStringlstrlen
String ID: 1$"2 =$#$'!8$)$)*04$)u53$*:$/$0>4<$4:80lxwv$4:80lxwv$52+w$7$?;=$Z$\$\$cannot use operator[] with a string argument with
API String ID: 4052058988-2151770575
Opcode ID: be3123f3357e879f4270c53588c6fc3f64254e813a53378cbf386846d7d95a52
Instruction ID: d52ba13351ba4a324f7a6f7a00f127466ceb9abec5af3ef73cb60ab6959e21c5
Opcode Fuzzy Hash: be3123f3357e879f4270c53588c6fc3f64254e813a53378cbf386846d7d95a52
Instruction Fuzzy Hash: 80C2E270D04259CBDB25DF64C9447EEBBB0AF19308F1441DEE4496B282EBB85E88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0043B750 Relevance: 41.4, APIs: 5, Strings: 18, Instructions: 1133stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?), ref: 0043B862
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0043B906
GetPrivateProfileStringA.KERNEL32(?,3D203202,00000000,?,00000104,?), ref: 0043B9B9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043C4EE
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043C79B

Strings

)*04, xrefs: 0043BCD0
9%!, xrefs: 0043C681
), xrefs: 0043C07C
*:, xrefs: 0043BCD7
Z, xrefs: 0043C0F0
52+w, xrefs: 0043BCC9
)u53, xrefs: 0043B894
/, xrefs: 0043BAE6
\, xrefs: 0043B9BF
::'!, xrefs: 0043C678
'!8, xrefs: 0043C469
\, xrefs: 0043BBFB
7, xrefs: 0043B89B
&:909%!, xrefs: 0043C53D, 0043C544
?;=, xrefs: 0043B929
::'!, xrefs: 0043B7CF
1, xrefs: 0043BD0F
0>4<, xrefs: 0043B88D

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: 1$&:909%!$'!8$)$)*04$)u53$*:$/$0>4<$52+w$7$9%!$::'!$::'!$?;=$Z$\$\
API String ID: 3203477177-3228426408
Opcode ID: 534182b2e5783794df3403b270118884bb5b74f758ad4123d1b78da7820507f7
Instruction ID: c93978f290d7d1d8c968389482369432632287792869b1679fa0885db036a378
Opcode Fuzzy Hash: 534182b2e5783794df3403b270118884bb5b74f758ad4123d1b78da7820507f7
Instruction Fuzzy Hash: AAB2D470D04258DBDB25DB64CC44BEEBBB0AF19308F1441DED449BB282DB789A89CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004202AA Relevance: 40.6, Strings: 31, Instructions: 1844COMMON

Download Yara Rule

Strings

\, xrefs: 00420908
$bd, xrefs: 00421869
><3<8, xrefs: 00421E5E, 00421E65
$.(-, xrefs: 00420F9D
\, xrefs: 00420892
$be, xrefs: 004218AC
$.(-, xrefs: 00420FEF
\, xrefs: 00420D88
', xrefs: 0042104E
cannot use operator[] with a string argument with , xrefs: 004222CA, 0042231F
2, xrefs: 004221C5
7=7', xrefs: 004210C8
"!;3?;=, xrefs: 00421C1B, 00421C44
$.(-, xrefs: 00421098
7=7', xrefs: 00420713
><3<8$, xrefs: 004220C7, 004220CD
', xrefs: 0042072A
/',<, xrefs: 004210D2
', xrefs: 004210E8
/',<, xrefs: 0042071A
\, xrefs: 00420D12
/',<, xrefs: 00421038
"2'&!8*=, xrefs: 00421FB5, 00421FDC
N, xrefs: 00422330
\, xrefs: 00420B6F
7=7', xrefs: 0042102E
\, xrefs: 00421307
\, xrefs: 004204DA
'!8, xrefs: 00421D7C
\, xrefs: 0042128B
\, xrefs: 00420369

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "!;3?;=$"2'&!8*=$$.(-$$.(-$$.(-$$bd$$be$'$'$'$'!8$/',<$/',<$/',<$2$7=7'$7=7'$7=7'$><3<8$><3<8$$N$\$\$\$\$\$\$\$\$\$cannot use operator[] with a string argument with
API String ID: 0-1876853861
Opcode ID: e2cc1c15a39ffa3081a3729397234da8590735d2a06667bd3bee6a7ac58d9cd5
Instruction ID: 23905bb18fd000cec8556e00b281b5b68f5f5e10fed6cbdd06ccf3518dd8b67d
Opcode Fuzzy Hash: e2cc1c15a39ffa3081a3729397234da8590735d2a06667bd3bee6a7ac58d9cd5
Instruction Fuzzy Hash: F403E070D002A8DADF25DF68C844BEEBBB0AF15304F5441DED44967292DBB85B88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0044A8F0 Relevance: 38.1, APIs: 6, Strings: 15, Instructions: 1320COMMON

Download Yara Rule

APIs

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?), ref: 0044AD86
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,?,?,?,06111778,?,?), ref: 0044AF74
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?,?,?,?,?,?,?,161B1778,?,?), ref: 0044B176
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?,10070678,?,?), ref: 0044B404

Strings

&80, xrefs: 0044AB17
175, xrefs: 0044AAC4
&80, xrefs: 0044AABA
{, xrefs: 0044B1E3
:, xrefs: 0044ABFE
&80175>>., xrefs: 0044AAF1
{, xrefs: 0044B0F2
&80115?(, xrefs: 0044AA91, 0044AA9E
$1#, xrefs: 0044AB21
>>., xrefs: 0044AACE
~s, xrefs: 0044AC71
type must be boolean, but is , xrefs: 0044C114
, xrefs: 0044C029
*, xrefs: 0044BCE3
z}y|, xrefs: 0044BC9A, 0044BCCC

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath$AttributesErrorFileLast
String ID: $1#$175$ $ &80$ &80$ &80115?($ &80175>>.$*$:$>>.$type must be boolean, but is $z}y|${${$~s
API String ID: 133263752-2053842511
Opcode ID: 6edfaad16dd15c7f831997d1fbcf71e291bdac98c86e44854bbd1af8dce9ca3d
Instruction ID: edb6fcdc740fcd203abd4a1a4372474ddc1a219639bcc899f6d1fc62923c7786
Opcode Fuzzy Hash: 6edfaad16dd15c7f831997d1fbcf71e291bdac98c86e44854bbd1af8dce9ca3d
Instruction Fuzzy Hash: EEC2D070D002589AEF25DF64C858BEEBBB4AF16304F1081DED44977282EB785B89CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0043CA90 Relevance: 37.1, APIs: 1, Strings: 19, Instructions: 2057COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32(00000000,00000001,00000000,?,?,?,><3<8$,><3<8$,00000001), ref: 0043DFD9

Part of subcall function 0040AF70: GetModuleHandleA.KERNEL32(3930271C), ref: 0040AFE5
Part of subcall function 0040AF70: GetProcAddress.KERNEL32(00000000,12382700), ref: 0040AFF0

Strings

><3<8$, xrefs: 0043D2DB, 0043D30C
hHS, xrefs: 0043E975
><3<8, xrefs: 0043D875, 0043D8A2
"2'&!8*=, xrefs: 0043D20D, 0043D214
'!8, xrefs: 0043D6C6, 0043D6F3
8, xrefs: 0043E3FD
!8*=, xrefs: 0043E595
"2'&!8*=, xrefs: 0043DA25, 0043DA52
><3<8$, xrefs: 0043CB53, 0043CB83
"!;3?;=, xrefs: 0043D53E, 0043D56C
"!;3?;=, xrefs: 0043CE89, 0043CEAC
><3<8$, xrefs: 0043DB92, 0043DBC2
8$, xrefs: 0043DEB4
!, xrefs: 0043E905
"!;3?;=, xrefs: 0043E185, 0043E1AC
'!8, xrefs: 0043CFE4
cannot use operator[] with a string argument with , xrefs: 0043DCF1, 0043DD26, 0043DD76, 0043DDA9, 0043DDFE, 0043E8F4, 0043E946
><3<, xrefs: 0043DEAD
'!8, xrefs: 0043E2C4, 0043E2F1

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressCredEnumerateHandleModuleProc
String ID: !$!8*=$"!;3?;=$"!;3?;=$"!;3?;=$"2'&!8*=$"2'&!8*=$'!8$'!8$'!8$8$8$$><3<$><3<8$><3<8$$><3<8$$><3<8$$cannot use operator[] with a string argument with $hHS
API String ID: 2949927473-1437918641
Opcode ID: 9c8a200175ba7f40ef5701e0636ccd82f9f048b5d949ea70d4bead243f041054
Instruction ID: 066672279fb6fdae9836c2dcee111eee1fbb7ccffcc1ffbf2bea6a5a1071ae00
Opcode Fuzzy Hash: 9c8a200175ba7f40ef5701e0636ccd82f9f048b5d949ea70d4bead243f041054
Instruction Fuzzy Hash: 4213AC70C002989FDB25DF68C894BEEBBB1AF59304F1481DED44967382DB785A89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0045A490 Relevance: 35.9, Strings: 28, Instructions: 886
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"2 =, xrefs: 0045B1FA
<290, xrefs: 0045AA61
w ]p, xrefs: 0045AAFB
>(r), xrefs: 0045AF33
'!8, xrefs: 0045B159
$28 3, xrefs: 0045AAB7
'!8, xrefs: 0045B182
!$=+, xrefs: 0045A4CE
), xrefs: 0045A4D8
w ^p, xrefs: 0045B241
%1, xrefs: 0045B0B8
8;78, xrefs: 0045AC18
>(, xrefs: 0045AC1F
), xrefs: 0045AC4B
9115, xrefs: 0045A4FA
&+, xrefs: 0045AF3A
8;78, xrefs: 0045AF2C
<290, xrefs: 0045AA31
6u(%, xrefs: 0045A7F3
%1, xrefs: 0045A974
*, xrefs: 0045A7FA
|',!, xrefs: 0045A835
6, xrefs: 0045A504
"2 =, xrefs: 0045B1CA
!$=+, xrefs: 0045AC41
$28 3, xrefs: 0045AA91
|',!, xrefs: 0045AF79
9115, xrefs: 0045A7EC

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AttributesCreateDirectoryErrorFileLast
String ID: !$=+$!$=+$"2 =$"2 =$$28 3$$28 3$%1$%1$&+$'!8$'!8$)$)$*$6$6u(%$8;78$8;78$9115$9115$<290$<290$>($>(r)$w ]p$w ^p$|',!$|',!
API String ID: 674977465-1310367266
Opcode ID: cf79787d20b9fdde4aebdf231145ceb7cdc9beee516a7e86f7579d5da9f20a00
Instruction ID: 443d7c8e7de7a932d6356f6d7193eec45498cc015ea55a0ce504edb69b8ec486
Opcode Fuzzy Hash: cf79787d20b9fdde4aebdf231145ceb7cdc9beee516a7e86f7579d5da9f20a00
Instruction Fuzzy Hash: 8B92A170800298DEDB25DB65C9547DEBBB0AF11308F4401DED44A77292EBB81F89DF9A

Uniqueness

Uniqueness Score: -1.00%

Function 004176B0 Relevance: 34.7, APIs: 8, Strings: 11, Instructions: 1401registryfileCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,00000104), ref: 004177CC
CopyFileA.KERNEL32(?,?,00000000), ref: 00417A9B
RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020006,?), ref: 00417B24
RegSetValueExA.KERNELBASE(?,?,00000000,00000001,?,?), ref: 00417B59
RegCloseKey.ADVAPI32(?), ref: 00417B62
CopyFileA.KERNEL32(?,?,00000000), ref: 00417F3D

Part of subcall function 004160B0: GetModuleHandleA.KERNEL32(3B263619,?), ref: 00416186
Part of subcall function 004160B0: GetProcAddress.KERNEL32(00000000,34312111), ref: 00416191
Part of subcall function 004160B0: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004161E1

__Xtime_get_ticks.LIBCPMT ref: 00418832
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00418840

Strings

\, xrefs: 004178E6
I5=I, xrefs: 004183AA
H, xrefs: 004183B4
3, xrefs: 0041876B
ps{!8wz, xrefs: 00418126, 00418129
".?9, xrefs: 004182C6
ps{!$wz, xrefs: 00418091, 00418094
|6,0, xrefs: 004179C0, 004179C3
F/!., xrefs: 004182BC
/, xrefs: 0041890C
\, xrefs: 00417DA2

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CopyFile$AddressCloseCreateHandleModuleNameOpenProcProcessUnothrow_t@std@@@UserValueXtime_get_ticks__ehfuncinfo$??2@
String ID: ".?9$/$3$F/!.$H$I5=I$\$\$ps{!$wz$ps{!8wz$|6,0
API String ID: 3014538992-93314115
Opcode ID: e44c68f8324a9d898aa1e99d1a7a8950320aa0563ef42a9040ceb01c8f098bae
Instruction ID: dd7755f2b3b60df83438b1c40db03fd9a69dbbc7292c3b7d1adc47f217cdb092
Opcode Fuzzy Hash: e44c68f8324a9d898aa1e99d1a7a8950320aa0563ef42a9040ceb01c8f098bae
Instruction Fuzzy Hash: ADD2F370C042588FDF15CF64C9597EEBBB1AF15308F14829EE0497B292EB785AC8CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004378A0 Relevance: 34.3, APIs: 4, Strings: 15, Instructions: 1023stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004379A8
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00437A51
GetPrivateProfileStringA.KERNEL32(?,3D203202,00000000,?,00000104,?), ref: 00437B09
lstrlenA.KERNEL32(?), ref: 0043865B

Strings

E, xrefs: 00437FDB
0>4<, xrefs: 004379D3
/, xrefs: 00437C36
7, xrefs: 004379E1
)u53, xrefs: 004379DA
3& :0>45, xrefs: 0043793D, 00437944
<290, xrefs: 00438323, 0043832A
\, xrefs: 00437D4B
, xrefs: 004386E9
$28 3, xrefs: 00438424, 0043844C
3& :0>45, xrefs: 004385F7, 004385FA
\, xrefs: 00437B0F
(:$, xrefs: 004381E3
cannot use operator[] with a string argument with , xrefs: 004386D8, 0043872D
1, xrefs: 00437E69

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: $ 1$$28 3$(:$$)u53$/$0>4<$3& :0>45$3& :0>45$7$<290$E$\$\$cannot use operator[] with a string argument with
API String ID: 1311570089-3057292652
Opcode ID: 81aeb78f60b4245dd423f2f49d8adf1543301c7dc42bfe6c9f11075fc0062a50
Instruction ID: ddf5894e4190de8f0e61275d0d4fb3d3b3478f7ba823619425044a5b04d8193a
Opcode Fuzzy Hash: 81aeb78f60b4245dd423f2f49d8adf1543301c7dc42bfe6c9f11075fc0062a50
Instruction Fuzzy Hash: 77A20570D04258DBDF24DF64C844BDEBBB4AF19308F1441DEE449A7282EB789A89CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0042B670 Relevance: 27.6, APIs: 2, Strings: 13, Instructions: 1311COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,21273A3A,?,?,?,?), ref: 0042B7A1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042C4A7

Strings

9%!, xrefs: 0042C7EC
\, xrefs: 0042B8F2
::'!, xrefs: 0042C7E3
\, xrefs: 0042BF10
@, xrefs: 0042C696
\, xrefs: 0042BE98
$, xrefs: 0042C939
::'!, xrefs: 0042B6EA
&:90, xrefs: 0042C50C, 0042C53C
'!8, xrefs: 0042C2D2, 0042C2FF
cannot use operator[] with a string argument with , xrefs: 0042C928
#;,, xrefs: 0042C62D
#;,, xrefs: 0042BD07

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPathUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: #;,$#;,$$$&:90$'!8$9%!$::'!$::'!$@$\$\$\$cannot use operator[] with a string argument with
API String ID: 2082173394-2580547700
Opcode ID: 93de412a9f55b99bffdb22614eea30817ded2027ad5d2aec33d4b94db09519ae
Instruction ID: a10301453e4d2261c24946cc2977acfa72d8dfac12b8f5d12bf0412471090912
Opcode Fuzzy Hash: 93de412a9f55b99bffdb22614eea30817ded2027ad5d2aec33d4b94db09519ae
Instruction Fuzzy Hash: AAC2E270D00268CBDB24DF68DD447EEBBB0AF55304F14819EE449AB282DB785E88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040B300 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 297
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,?,DT,?,?,?,\*.*,00000004), ref: 0040B423
std::_Throw_Cpp_error.LIBCPMT ref: 0040B714
std::_Throw_Cpp_error.LIBCPMT ref: 0040B725

Strings

DT, xrefs: 0040B3B8
\*.*, xrefs: 0040B3B0

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$FileFindFirst
String ID: \*.*$DT
API String ID: 1487763586-2523999094
Opcode ID: 4a29aba26bec869d3660ca0283637983aa92af40795304ad3570c6c34889b601
Instruction ID: ac939954ec097e0f466dd701cbb477dfb9ac36ed8f0a1d488013fd253ef2818d
Opcode Fuzzy Hash: 4a29aba26bec869d3660ca0283637983aa92af40795304ad3570c6c34889b601
Instruction Fuzzy Hash: FCC1CF70D00249CFDB10DFA4C8487EEBBB1FF55314F14426AE044BB292E7B45A88DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0043C800 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE($2!9"440t?01), ref: 0043C845
GetProcAddress.KERNEL32(00000000,?), ref: 0043C890
GetProcAddress.KERNEL32(?), ref: 0043C8CC
GetProcAddress.KERNEL32(39213204), ref: 0043C90B
GetProcAddress.KERNEL32(39213204), ref: 0043C94B
GetProcAddress.KERNEL32(?), ref: 0043C97E
GetProcAddress.KERNEL32(39213204), ref: 0043C9BD
GetProcAddress.KERNEL32(39213204), ref: 0043C9FC
FreeLibrary.KERNEL32 ref: 0043CA51

Strings

4=(, xrefs: 0043C922
$2!9"440t?01, xrefs: 0043C83D, 0043C844
2+, xrefs: 0043C929

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: $2!9"440t?01$2+$4=(
API String ID: 2449869053-1843404136
Opcode ID: f423dc4987d352ac9937d848cd9fb5e714644b23985bd1ebfd8db31034e5f883
Instruction ID: b30b69da85a4116f3a82840f577a0ae83ca26ffad3fe6e2f7a477cc7da58665a
Opcode Fuzzy Hash: f423dc4987d352ac9937d848cd9fb5e714644b23985bd1ebfd8db31034e5f883
Instruction Fuzzy Hash: 4A710270814288CAEB09CFA4E8487EEBBF8EF2A308F10406ED444BA621D375461DDF65

Uniqueness

Uniqueness Score: -1.00%

Function 00423670 Relevance: 18.7, APIs: 1, Strings: 9, Instructions: 1183COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 004237AB

Strings

#;,, xrefs: 0042441E
#;,, xrefs: 00423CFD
\, xrefs: 00423F0B
\, xrefs: 004238F3
@, xrefs: 0042448B
, xrefs: 00424515
"2 =, xrefs: 0042438E, 00424395
'!8, xrefs: 004242CA
\, xrefs: 00423E93

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: $"2 =$#;,$#;,$'!8$@$\$\$\
API String ID: 1514166925-759053580
Opcode ID: caef5bf67891b5adbdf502c28c531be5ecf46fc3c45987f65919bad8b113327f
Instruction ID: 5e4413c7f963dead2597c5e4b13444e0529a0f2600b9e83200ec1b3ca6f7b0c6
Opcode Fuzzy Hash: caef5bf67891b5adbdf502c28c531be5ecf46fc3c45987f65919bad8b113327f
Instruction Fuzzy Hash: 3CB2D070E00268CBDB14DF68D9447EEBBB1BF55304F14429EE449AB382D7786E84CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041E220 Relevance: 18.3, APIs: 12, Instructions: 260
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(0000038C,0000FFFF,00001006,?,00000008), ref: 0041E2B2
recv.WS2_32(?,00000004,00000002), ref: 0041E2CD
WSAGetLastError.WS2_32 ref: 0041E2D1
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 0041E34F
recv.WS2_32(00000000,0000000C,00000008), ref: 0041E370
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 0041E40C
recv.WS2_32(00000000,?,00000008), ref: 0041E427

Part of subcall function 0041D430: WSAStartup.WS2_32 ref: 0041D45A
Part of subcall function 0041D430: getaddrinfo.WS2_32(?,?,?,00544318), ref: 0041D4DC
Part of subcall function 0041D430: socket.WS2_32(?,?,?), ref: 0041D4FD
Part of subcall function 0041D430: connect.WS2_32(00000000,?,?), ref: 0041D511
Part of subcall function 0041D430: closesocket.WS2_32(00000000), ref: 0041D51D
Part of subcall function 0041D430: freeaddrinfo.WS2_32(?,?,?,?,00544318,?,?), ref: 0041D52A
Part of subcall function 0041D430: WSACleanup.WS2_32 ref: 0041D530

recv.WS2_32(?,00000004,00000008), ref: 0041E52F
__Xtime_get_ticks.LIBCPMT ref: 0041E536
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041E544
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 0041E5BD
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 0041E5C5

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: recv$Sleepsetsockopt$CleanupErrorLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectfreeaddrinfogetaddrinfosocket
String ID:
API String ID: 4125349891-0
Opcode ID: 4f16ea895f53ca580b03d975fca0a4645a27b0bc826a97079c23b567da2f2c96
Instruction ID: 445f019a92e67a07c5577944838b6ba889f153fe2f7e7f97530082f2635256d3
Opcode Fuzzy Hash: 4f16ea895f53ca580b03d975fca0a4645a27b0bc826a97079c23b567da2f2c96
Instruction Fuzzy Hash: BFB1BB74D00208DFDB10DFA5DC49BDEBBB1BF55308F20421AE514AB2D2E7B85989DB85

Uniqueness

Uniqueness Score: -1.00%

Function 004224D9 Relevance: 17.4, Strings: 13, Instructions: 1131COMMON

Download Yara Rule

Strings

), xrefs: 00423615
#;,, xrefs: 00423324
\, xrefs: 004225E2
\, xrefs: 00422B96
, xrefs: 004233E7
3& :0>45, xrefs: 004234C4, 004234C7
<290, xrefs: 004230FE, 00423105
(:$, xrefs: 00422FCE
@, xrefs: 0042338B
$28 3, xrefs: 00423205, 0042322C
cannot use operator[] with a string argument with , xrefs: 00423604
\, xrefs: 00422C0E
(:$, xrefs: 00422FAF

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $#;,$$28 3$(:$$(:$$)$3& :0>45$<290$@$\$\$\$cannot use operator[] with a string argument with
API String ID: 0-679915065
Opcode ID: f63a384c59880e2be165f08f3d30151c608e8e3c4723f2fe89255a400813af35
Instruction ID: bd44913ac096deb082ad73b4e6b56e58228a4cafe484209f312c39f122f53dde
Opcode Fuzzy Hash: f63a384c59880e2be165f08f3d30151c608e8e3c4723f2fe89255a400813af35
Instruction Fuzzy Hash: F0A2F170E002689BDB14DF68D9447EEBBB0BF15304F14419EE449AB382DB78AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00422852 Relevance: 14.6, Strings: 11, Instructions: 811COMMON

Download Yara Rule

Strings

<290, xrefs: 004230FE, 00423105
), xrefs: 00423615
(:$, xrefs: 00422FCE
$28 3, xrefs: 00423205, 0042322C
\, xrefs: 00422B96
, xrefs: 004233E7
cannot use operator[] with a string argument with , xrefs: 00423604
\, xrefs: 00422C0E
, xrefs: 00423315
(:$, xrefs: 00422FAF
3& :0>45, xrefs: 004234C4, 004234C7

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $ $$28 3$(:$$(:$$)$3& :0>45$<290$\$\$cannot use operator[] with a string argument with
API String ID: 0-3638146340
Opcode ID: fe2ab4d2ad1567dab63afe1e3d22029045f78d3a9c3f3e081433c69fa4c23e38
Instruction ID: eb2dd55f6141e2d675d9ff2e9574dc4233fb147083f3686e6ff04d1ed0a00ccf
Opcode Fuzzy Hash: fe2ab4d2ad1567dab63afe1e3d22029045f78d3a9c3f3e081433c69fa4c23e38
Instruction Fuzzy Hash: AC72E270E00268DBDB24DF68D9447EEBBB0BF15304F14429ED44967382DB789A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040C490 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 416registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF30: GetCurrentProcess.KERNEL32(00000000,?,?,0040C4BE), ref: 0040AF3F
Part of subcall function 0040AF30: IsWow64Process.KERNEL32(00000000,?,0040C4BE), ref: 0040AF46

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,-00020019,00000000,3B3F3D07,3B3F3D08,00000000), ref: 0040C571
RegQueryValueExA.KERNELBASE(00000000,3D37321F,00000000,00020019,?,00000400), ref: 0040C5D1
RegCloseKey.ADVAPI32(00000000), ref: 0040C600
GetCurrentHwProfileA.ADVAPI32(?), ref: 0040C687

Strings

___, xrefs: 0040C6FE, 0040C726
_, xrefs: 0040C6E6
_, xrefs: 0040C6D1
9 6, xrefs: 0040C60F

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CurrentProcess$CloseOpenProfileQueryValueWow64
String ID: 9 6$_$_$___
API String ID: 165412945-709806127
Opcode ID: 6d39ac5e6559a84b2e37df2bcb40e37a48af7f12a317e9fc37ea14b32202a4b5
Instruction ID: b6e6a19ac1b1cbb26a093045ac3f8d51f6027d5e17e321542ac0e50d899cf592
Opcode Fuzzy Hash: 6d39ac5e6559a84b2e37df2bcb40e37a48af7f12a317e9fc37ea14b32202a4b5
Instruction Fuzzy Hash: F502E370C00258DEDB15CFA4C894BEEBB74AF15308F1442AEE44577292EBB95B88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004160B0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162processlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(3B263619,?), ref: 00416186
GetProcAddress.KERNEL32(00000000,34312111), ref: 00416191
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004161E1

Strings

589., xrefs: 0041612C
D, xrefs: 004160EB
t?01, xrefs: 0041627E
3;kk, xrefs: 0041615A

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressCreateHandleModuleProcProcess
String ID: 3;kk$589.$D$t?01
API String ID: 3485509086-2234503220
Opcode ID: 60fdf11987f52a907e9139c4ff7ff0b270cfe81cb3f605bd94377336c0d26766
Instruction ID: 584c3f6ed54951fa46cdd62f7e73c497529d8eb16fd8f44b13c31fb8133d280f
Opcode Fuzzy Hash: 60fdf11987f52a907e9139c4ff7ff0b270cfe81cb3f605bd94377336c0d26766
Instruction Fuzzy Hash: AE51F170E00258AFDB14CFA8CC85BEEBBB4FF44704F14419EE509AB292D778A945CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00422360 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 365COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,3& :0>45,?,?,?,?), ref: 00422491

Strings

3& :0>45, xrefs: 004223FE, 00422405
), xrefs: 00423615
#;,, xrefs: 004229E3
cannot use operator[] with a string argument with , xrefs: 004235A0, 00423604
\, xrefs: 00422C0E

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: #;,$)$3& :0>45$\$cannot use operator[] with a string argument with
API String ID: 1514166925-1855882293
Opcode ID: 705680f525d4b3f802cd47da5f0cb166720df11a01530888af75cd8aa1bbae92
Instruction ID: 2cac8e893caf096c73f10a18816257fa98d3f374838489ee5a6c4980580f9952
Opcode Fuzzy Hash: 705680f525d4b3f802cd47da5f0cb166720df11a01530888af75cd8aa1bbae92
Instruction Fuzzy Hash: 6EF1BD70D04268DADB14DF64C955BDEBBB4BF15308F1482DEE44967282DBB81B88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00406430 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 352COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004065C1
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004065FE
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004066F1
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0040673E

Strings

., xrefs: 00406710

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 8417005a20e023fd73ba9afad58ff86ec2193d77c7355dce5408bdd34dd6c1b5
Instruction ID: 0ef23cfc4c65f78b20a5b115fbe71865ac88f3790106b09d81af8426c26c804f
Opcode Fuzzy Hash: 8417005a20e023fd73ba9afad58ff86ec2193d77c7355dce5408bdd34dd6c1b5
Instruction Fuzzy Hash: 5AD1D071900616DFCB20CF58C8947AEB7B4FF48328F15466AD816A77C0D73AAD65CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA10 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 271fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0100790E,?,?,0100790E,0100790F), ref: 0041FAA5

Strings

\, xrefs: 0041FB3B

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: \
API String ID: 1974802433-2967466578
Opcode ID: c2a6168d3e0ac44845aec6a84b4bfa641a2ca9e67cddc6f64b4a54fc605115d6
Instruction ID: 0eabd7acd7812341df4d8f5e7d8ba5b9313bc1fcfed4fcfaeac043b0cd9dd738
Opcode Fuzzy Hash: c2a6168d3e0ac44845aec6a84b4bfa641a2ca9e67cddc6f64b4a54fc605115d6
Instruction Fuzzy Hash: F8B1D0708002498FDF15CFA8C8587FEBBB0BF15308F14425EE455AB292D7785A8ADB94

Uniqueness

Uniqueness Score: -1.00%

Function 00431430 Relevance: 8.0, Strings: 6, Instructions: 493COMMON

Download Yara Rule

Strings

-, xrefs: 00431853
(, xrefs: 0043199C
n: , xrefs: 00430FE9
' 1'865<, xrefs: 0043121D, 00431224
-, xrefs: 0043187D
P.^, xrefs: 004314D9

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID: ' 1'865<$($-$-$P.^$n:
API String ID: 2638373210-269613232
Opcode ID: d3363137bc850aabcc61f2d02b65d685715bcac0377b4b823f16cf6892d1055e
Instruction ID: 06e47fb3e71705996d4c10820d621363cd6d4ebf6feef214284d50ab64b5b3c6
Opcode Fuzzy Hash: d3363137bc850aabcc61f2d02b65d685715bcac0377b4b823f16cf6892d1055e
Instruction Fuzzy Hash: 0722D170D00288DFDF14DFA8C9597EDBBB0AF15308F14819ED445AB382EBB85A48DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0045D9F0 Relevance: 7.7, APIs: 5, Instructions: 159sleepCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 0045DA07
GetCursorPos.USER32(?), ref: 0045DA15
Sleep.KERNELBASE(000003E9,?,?,00000000,?,?,?,?,?,?,?,?,0045DDB8), ref: 0045DACA
GetCursorPos.USER32(?), ref: 0045DAD1
Sleep.KERNELBASE(00000001,?,?,00000000,?,?,?,?,?,?,?,?,0045DDB8), ref: 0045DB87

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cursor$Sleep
String ID:
API String ID: 1847515627-0
Opcode ID: 1305e8b84abd8f11ed362210ed92b6921c6aed97f625362779b6103c1612edfd
Instruction ID: e8049105a74d3e0261715eac98f4d2121e3debad5535f3f1e8485cbb4cdad7bb
Opcode Fuzzy Hash: 1305e8b84abd8f11ed362210ed92b6921c6aed97f625362779b6103c1612edfd
Instruction Fuzzy Hash: 70519A31A082428FCB24CF18C4D0E6AB7E2EF89705F19499EE8859B352D735FD49CB85

Uniqueness

Uniqueness Score: -1.00%

Function 004CB3C0 Relevance: 6.9, Strings: 4, Instructions: 1918COMMON

Download Yara Rule

Strings

min, xrefs: 004CCC6B
max, xrefs: 004CCCCE
too many terms in compound SELECT, xrefs: 004CB666
only a single result allowed for a SELECT that is part of an expression, xrefs: 004CB6AC

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: max$min$only a single result allowed for a SELECT that is part of an expression$too many terms in compound SELECT
API String ID: 0-2877691265
Opcode ID: da226f26012b65685aa223540cd344d9d8acf49faf47b2076c4c2ecae620ebc1
Instruction ID: c1929985df6c20adc65602af42118a6c04867d104e31f5cdb5b9dcf57f3213a0
Opcode Fuzzy Hash: da226f26012b65685aa223540cd344d9d8acf49faf47b2076c4c2ecae620ebc1
Instruction Fuzzy Hash: 881356746047418FD724DF19C090F2ABBE1FF85308F15896EE98A8B352DB79E845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004F636F Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004F67B4,00000000,00000000,00000000), ref: 004F6673

Strings

W. Europe Summer Time, xrefs: 004F6720
W. Europe Standard Time, xrefs: 004F670C

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 565725191-690618308
Opcode ID: 83fdf657cb7f9a7a8f95d9276a717656136ca0864d6a24c16211394cc139b29d
Instruction ID: 9cad27d5f2b54b569fbe64af901152f9cd98cd860f96ba3425b9b03ecf62c301
Opcode Fuzzy Hash: 83fdf657cb7f9a7a8f95d9276a717656136ca0864d6a24c16211394cc139b29d
Instruction Fuzzy Hash: 91C12672D00119ABDB14BB65DC02ABF7BB9EF04758F11406BFA01EB295E7389E01D798

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000000,000000FF), ref: 0041F3E5
LocalFree.KERNEL32(?), ref: 0041F414

Strings

jjjj, xrefs: 0041F3D9

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID: jjjj
API String ID: 1561624719-48926182
Opcode ID: aa4404672b2df8b18a26a615dff9fcff1f65acf6459e9ad9dae77a66ff4ba265
Instruction ID: 409469ce869bb278a755ece448acb5b2db033f64c44fe4e4698fcece5c69adc3
Opcode Fuzzy Hash: aa4404672b2df8b18a26a615dff9fcff1f65acf6459e9ad9dae77a66ff4ba265
Instruction Fuzzy Hash: DDF0A7B2C4011896DF109BA49C01BEFB765FB54721F004037DC59A3340EB3948898ADA

Uniqueness

Uniqueness Score: -1.00%

Function 004DB1CB Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,0046BEC7,?,00000000,?,00473681,?,00000000), ref: 004DB1D7
FindFirstFileExW.KERNELBASE(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,0046BEC7,?,00000000,?,00473681,?,00000000), ref: 004DB206
GetLastError.KERNEL32(?,0046BEC7,?,00000000,?,00473681,?,00000000), ref: 004DB218

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: f1d414bdb1a830b9c19e1c1a91ab6db378ddacdc0024ae8e2650c4f043538abd
Instruction ID: 8aa795b071709f9ad919938827d4aff15d16b66e82d9f8c16838a8eaa28f277c
Opcode Fuzzy Hash: f1d414bdb1a830b9c19e1c1a91ab6db378ddacdc0024ae8e2650c4f043538abd
Instruction Fuzzy Hash: D9F05431000508FFDB111FA5DC189AF7B9CEF143B0B108627BD68C56A0D73199A296E4

Uniqueness

Uniqueness Score: -1.00%

Function 00496450 Relevance: 2.0, APIs: 1, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47df8a979cf4f857dc537b9ef44913b95696ce48800f52ac5a31c4eb421a18d
Instruction ID: e16f3952025df4b57fbfa53020dcabc30b9a59b88706b4710c7fb5b6fa6fa324
Opcode Fuzzy Hash: f47df8a979cf4f857dc537b9ef44913b95696ce48800f52ac5a31c4eb421a18d
Instruction Fuzzy Hash: D4028EB06047019FDB64CF29C840B27BBE0AF89314F15493EE48AC7751DB78E949CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004E925D Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 004E93E1

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 79f90e00dc77957be7610ff531ea09f8d3cb8def4dcd7f8d4dea2ba9a82dffaa
Instruction ID: b0f2f4a4c71a32763588803a0d4209da0bfab023c608772363e77a77a94ad2d5
Opcode Fuzzy Hash: 79f90e00dc77957be7610ff531ea09f8d3cb8def4dcd7f8d4dea2ba9a82dffaa
Instruction Fuzzy Hash: 30B1E17190468A9BCB35CF6BC4956BFB7A1AF08306F140A1FD992973C1C739AD02CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0048C560 Relevance: .7, Instructions: 663COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aead1b18fa6655e2046488e2d56f3586447149cbf6bdb60b8fae25e10e23de9f
Instruction ID: d460b15ecaef89ee619ee12d19a6560aac0686608ff237d971a34b1c2572f41b
Opcode Fuzzy Hash: aead1b18fa6655e2046488e2d56f3586447149cbf6bdb60b8fae25e10e23de9f
Instruction Fuzzy Hash: 4342B070A006458FDB14EE78C8807AEFBA1FF45310F148A6ED4A5E7781D738E54ACBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0048D250 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0702e79ebe35d7f2eab4924e86644c543a8bfec9af84c7524f60a6a2cffea22b
Instruction ID: 0f76039a442bb9952bef901009f789ffb67366a02fe10e258d8ab1312df69022
Opcode Fuzzy Hash: 0702e79ebe35d7f2eab4924e86644c543a8bfec9af84c7524f60a6a2cffea22b
Instruction Fuzzy Hash: C2B19F71A057019FC720EE69C840A5BB7E1EF88324F144F2EF8AAD3790D778E9458B56

Uniqueness

Uniqueness Score: -1.00%

Function 00442BC0 Relevance: 219.9, APIs: 40, Strings: 84, Instructions: 2868fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 00442C53
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442CAF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004434EF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443639
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0044337F

Part of subcall function 0040E7B0: FindFirstFileA.KERNEL32(00000000,7F7A790F,?,7F7A790E,00445E27,00000000,7F7A790E,7F7A790F,74DF3100,?), ref: 0040E929

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442CE0

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442E08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442E37
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00442F2F
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443029
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443087
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004431B8
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0044324A

Strings

7;x, xrefs: 00444E9A
0>?, xrefs: 00444374
9:, xrefs: 00444EB0
9"6-, xrefs: 0044596A
)u$0, xrefs: 00445974
6:, xrefs: 00442C7A
%26>, xrefs: 004447EF
4>(, xrefs: 00443C5A
3$, xrefs: 00442FEB
";=w, xrefs: 00443C50
ghi, xrefs: 00444B90
3y<8, xrefs: 00443168
759*, xrefs: 004451E3
4(r), xrefs: 0044452A
9"6-, xrefs: 004439B5
0(33, xrefs: 00445369
)u6., xrefs: 004439BF
315, xrefs: 00442CF2
.4.<, xrefs: 00444EA6
"83<, xrefs: 00444520
.4.<, xrefs: 00444E0C
;26-, xrefs: 004449D9
+, xrefs: 00445E83
.4.<, xrefs: 00444DAA
9"6-, xrefs: 004459DE
! 2;, xrefs: 0044420F, 00444212
3>2), xrefs: 00443A65
759*, xrefs: 00445271
"?=+, xrefs: 0044388C
t224, xrefs: 00442EE6
1,), xrefs: 00442EDC
2, xrefs: 004459F2
315, xrefs: 00442C70
#9;1, xrefs: 004436AF
0(33, xrefs: 004452EE
4>(, xrefs: 00443CBF
*, xrefs: 00443BB8
34*8, xrefs: 0044320A
2, xrefs: 00445A50
7;x, xrefs: 00444DA0
k, xrefs: 00444B9A
9"6-, xrefs: 00445A3C
11, xrefs: 004439C9
|76, xrefs: 00445641
)u$0, xrefs: 004459E8
0+, xrefs: 004438A0
w Y_[], xrefs: 004445DC, 004445E2
0>?w, xrefs: 0044535F
?), xrefs: 004436B9
?0, xrefs: 00443E49
61, xrefs: 00443E15
7:, xrefs: 00443FFD
!#7), xrefs: 00443047
%1, xrefs: 0044455F
&2, xrefs: 0044485C
)u(%, xrefs: 00443BAE
2, xrefs: 0044597E
$'4<, xrefs: 0044585E
., xrefs: 00443172
1<:3, xrefs: 00443E3F
</, xrefs: 00443214
9:, xrefs: 00444E16
7;x, xrefs: 00444E02
|::<, xrefs: 0044562A, 0044562D
?(, xrefs: 004451ED
_, xrefs: 00444676
)u$0, xrefs: 00445A46
1>6, xrefs: 00445807
759*, xrefs: 0044518B
?(, xrefs: 0044527D
9:, xrefs: 00444DB4
0>?w, xrefs: 004452E4
?)/, xrefs: 004447F9
9"6-, xrefs: 00443BA4
&+, xrefs: 00444534
864, xrefs: 00444D02
3:, xrefs: 00443051
0>?, xrefs: 004443CF
";=w, xrefs: 00443CB5
6:, xrefs: 00442CFC
864, xrefs: 00444CA1
?(, xrefs: 00445195
0>?, xrefs: 00444477
|';-, xrefs: 004455FF, 00445602

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CreateDirectory$Copy$FolderPath$AttributesErrorFindFirstLast
String ID: 1,)$ghi$! 2;$!#7)$"83<$";=w$";=w$"?=+$#9;1$$'4<$%1$%26>$&+$&2$)u$0$)u$0$)u$0$)u(%$)u6.$*$+$.$.4.<$.4.<$.4.<$0(33$0(33$0+$0>?$0>?$0>?$0>?w$0>?w$11$1<:3$1>6$2$2$2$315$315$3$$34*8$3:$3>2)$3y<8$4(r)$4>($4>($61$6:$6:$759*$759*$759*$7:$7;x$7;x$7;x$864$864$9"6-$9"6-$9"6-$9"6-$9"6-$9:$9:$9:$;26-$</$?($?($?($?)$?)/$?0$_$k$t224$w Y_[]$|';-$|76$|::<
API String ID: 3765264142-139938508
Opcode ID: d0ef6f445f74236b45a801a89b02234199cc2a299b26c4be1559bc5011b2e69b
Instruction ID: 3de45bc02bde8f5d1410f05e926e2ccc20553a8a2b94b07571620541858a5efa
Opcode Fuzzy Hash: d0ef6f445f74236b45a801a89b02234199cc2a299b26c4be1559bc5011b2e69b
Instruction Fuzzy Hash: 4C538D70C04298DADB21EB65CD557DEBB74AF21308F4441EAD449772C2EBB81B88CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00474AC0 Relevance: 37.6, APIs: 16, Strings: 5, Instructions: 890
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00474FE3
___std_exception_destroy.LIBVCRUNTIME ref: 00474FF7
___std_exception_destroy.LIBVCRUNTIME ref: 0047510F
___std_exception_destroy.LIBVCRUNTIME ref: 00475123
___std_exception_destroy.LIBVCRUNTIME ref: 004751E0
___std_exception_destroy.LIBVCRUNTIME ref: 004751FA
___std_exception_destroy.LIBVCRUNTIME ref: 00475369
___std_exception_destroy.LIBVCRUNTIME ref: 0047537D
___std_exception_destroy.LIBVCRUNTIME ref: 00475452
___std_exception_destroy.LIBVCRUNTIME ref: 00475466
___std_exception_destroy.LIBVCRUNTIME ref: 0047554C
___std_exception_destroy.LIBVCRUNTIME ref: 00475560
___std_exception_destroy.LIBVCRUNTIME ref: 00475811
___std_exception_destroy.LIBVCRUNTIME ref: 00475825

Strings

array, xrefs: 004752AA
O, xrefs: 0047582D
object, xrefs: 00475391
number overflow parsing ', xrefs: 0047514A
value, xrefs: 00475752

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: O$array$number overflow parsing '$object$value
API String ID: 4194217158-306733086
Opcode ID: 61c38a80455432cc09a2b9c9bad55e33ddf206dade7b965c1c237f752aa70884
Instruction ID: 2b8bbb5fb6bef53096142a6844d47d0bb0a5a7ac0895a6da9de1fd59fd81eee6
Opcode Fuzzy Hash: 61c38a80455432cc09a2b9c9bad55e33ddf206dade7b965c1c237f752aa70884
Instruction Fuzzy Hash: 4192A170C00248DEDB10DFA4C944BEEBFB5BF55304F14859ED459BB282E7786A48CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004103C0 Relevance: 14.7, APIs: 2, Strings: 6, Instructions: 746COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,0000005C), ref: 00410419
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00410440

Strings

12*y, xrefs: 00412702
9>6, xrefs: 00412F18
\, xrefs: 0040F8DF
9%!, xrefs: 0041164A
$39, xrefs: 0041211E
z, xrefs: 00411A43

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: $39$12*y$9%!$9>6$\$z
API String ID: 1514166925-764209152
Opcode ID: 38d7cbbd41fdc934153250d5d17a244b39b369c64484e9a8fb66c168808b283b
Instruction ID: 59b6d6f339ba7e2f22b0134f03f68e765181b61f31e9b392b5e3c28a430878f0
Opcode Fuzzy Hash: 38d7cbbd41fdc934153250d5d17a244b39b369c64484e9a8fb66c168808b283b
Instruction Fuzzy Hash: E772DE70C0029D9ACF25DB64CD557EEB774AF15308F0442EAD04977292EBB82B89CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0040CAC0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 171registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNELBASE(80000002,?,34393C16,0001FFFF,00000001,?,00000104), ref: 0040CBD2
GetComputerNameExA.KERNELBASE(00000002,?,00000104), ref: 0040CC3C
LsaOpenPolicy.ADVAPI32(00000000,0054267C,00000001,00000000), ref: 0040CC95
LsaQueryInformationPolicy.ADVAPI32(00000000,0000000C,?), ref: 0040CCA8
LsaFreeMemory.ADVAPI32(?), ref: 0040CCD6
LsaClose.ADVAPI32(00000000), ref: 0040CCDF

Strings

?9, xrefs: 0040CB52
%wZ, xrefs: 0040CCC5

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ$?9
API String ID: 762890658-830384695
Opcode ID: a14e4553e443ecd4be1b87ce77b34667ff650a3cf470428272776160caaff946
Instruction ID: 5c12321940df4fd8fb71f447f481a877f50f156e5d1b3200ddc0c7ffc2d86234
Opcode Fuzzy Hash: a14e4553e443ecd4be1b87ce77b34667ff650a3cf470428272776160caaff946
Instruction Fuzzy Hash: 3B612671804348DBEB11DFA4DC49BEEBBB8FF09708F00426EE545B6182E7B55689CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00439A80 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 119COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00439BA8
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00439C52

Strings

)u53, xrefs: 00439BDA
7, xrefs: 00439BE1
?2+, xrefs: 00439B0C
0>4<, xrefs: 00439BD3
TbE, xrefs: 00439BAE
1<;>, xrefs: 00439B05

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderNamesPathPrivateProfileSection
String ID: )u53$0>4<$1<;>$7$?2+$TbE
API String ID: 2478605195-2592757414
Opcode ID: 1606ea9120c7d04a6346da00d7890c6e7c48432ada12fe9634ef06a45c9dc041
Instruction ID: 7174201a8848e788bf8bea569bcfc7b55b4c84013191dce98e5d5293a2ecbe93
Opcode Fuzzy Hash: 1606ea9120c7d04a6346da00d7890c6e7c48432ada12fe9634ef06a45c9dc041
Instruction Fuzzy Hash: 18519E74905398EEDB11DFA4CC45BCDBBB4AF15304F1040DAE549AB282D7B86B88CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0041D840 Relevance: 13.0, APIs: 4, Strings: 3, Instructions: 713libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,?,00000000,00000000,00000000), ref: 0041DBB6
GetProcAddress.KERNEL32(00000000,06150005), ref: 0041DBC1
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 0041DBD6
GetCurrentProcess.KERNEL32(00000000,?,?,?,00000000,00000000,00000000), ref: 0041DEDC

Strings

Ws2_32.dll, xrefs: 0041DBAD
39<, xrefs: 0041DB95
%1, xrefs: 0041DF09

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcessSend
String ID: %1$39<$Ws2_32.dll
API String ID: 3060695839-1710563983
Opcode ID: 385b1676973be124b293a0b3897a1b7b4b46c9ac62b799964ae5bbbd6be22116
Instruction ID: bb544734cddad546c251b080f02150c0b6b95f0d694eae3eeb7ddbcd143b20fb
Opcode Fuzzy Hash: 385b1676973be124b293a0b3897a1b7b4b46c9ac62b799964ae5bbbd6be22116
Instruction Fuzzy Hash: EE6225B0D04288DEDF10DFA8C9557EEBFB0AF15308F24415ED4456B282E7B85A88DBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0040B1A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207
std::_Throw_Cpp_error.LIBCPMT ref: 0040B24F
std::_Throw_Cpp_error.LIBCPMT ref: 0040B260

Strings

DT, xrefs: 0040B3B8
\*.*, xrefs: 0040B3B0
DT, xrefs: 0040B238

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID: \*.*$DT$DT
API String ID: 995686243-3062393244
Opcode ID: 7c93be0e39bac07192ae234e4444476cb8469c1607e3cac452f8ce700f80683a
Instruction ID: 98fd9ba19aa43d818a037ed0b56ad2d2959cead2aa0cd36f25e414e829a489f2
Opcode Fuzzy Hash: 7c93be0e39bac07192ae234e4444476cb8469c1607e3cac452f8ce700f80683a
Instruction Fuzzy Hash: 65110371940600E7CB205BA8A809BBE3654E713728F2087BFD425B77D0D73989048ADE

Uniqueness

Uniqueness Score: -1.00%

Function 0041D430 Relevance: 12.1, APIs: 8, Instructions: 92networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 0041D45A
getaddrinfo.WS2_32(?,?,?,00544318), ref: 0041D4DC
socket.WS2_32(?,?,?), ref: 0041D4FD
connect.WS2_32(00000000,?,?), ref: 0041D511
closesocket.WS2_32(00000000), ref: 0041D51D
freeaddrinfo.WS2_32(?,?,?,?,00544318,?,?), ref: 0041D52A
WSACleanup.WS2_32 ref: 0041D530
freeaddrinfo.WS2_32(?,?,?,?,00544318,?,?), ref: 0041D545

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: freeaddrinfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 58224237-0
Opcode ID: 1366ad5779fb1d9e896f6c3f08975c03dc1aab9f9250e2a0f463ba84f3e17d7b
Instruction ID: 3c9476e75c3fd4fec55e94a635383449f643eb380b6605d060e559485908137f
Opcode Fuzzy Hash: 1366ad5779fb1d9e896f6c3f08975c03dc1aab9f9250e2a0f463ba84f3e17d7b
Instruction Fuzzy Hash: A431C472904710ABC7209F25DC486ABB7E5BBD4368F104B1EF8B4932A0E374A8489656

Uniqueness

Uniqueness Score: -1.00%

Function 00407490 Relevance: 11.1, APIs: 1, Strings: 5, Instructions: 571COMMON

Download Yara Rule

APIs

Part of subcall function 004778C0: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00477949
Part of subcall function 004778C0: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00477991

GetFileAttributesA.KERNELBASE(?), ref: 004077C1

Strings

\, xrefs: 004078DB
.zip, xrefs: 004075A1
, xrefs: 00407B96
recursive_directory_iterator::recursive_directory_iterator, xrefs: 00407CE3
/, xrefs: 00407914

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_fs_convert_narrow_to_wide@20$AttributesFile
String ID: $.zip$/$\$recursive_directory_iterator::recursive_directory_iterator
API String ID: 2896367778-1520678085
Opcode ID: 2fad60e87e1e802c277f3282e679dfa3b8b58277df00ea7f9a444588ff8a1a58
Instruction ID: 83cbc35ccc226e9dfc96b22cc8f0aa30fdcd4d5be8d4862c17add94487e3c136
Opcode Fuzzy Hash: 2fad60e87e1e802c277f3282e679dfa3b8b58277df00ea7f9a444588ff8a1a58
Instruction Fuzzy Hash: 55429D70D05258DFDB10DFA8C9587DEBBB0BF15308F14819DE4097B282DB785A88CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0046CA20 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 523COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0046CCC0
___std_exception_destroy.LIBVCRUNTIME ref: 0046CCDA
___std_exception_destroy.LIBVCRUNTIME ref: 0046D09A
___std_exception_destroy.LIBVCRUNTIME ref: 0046D0B4

Strings

., xrefs: 0046D156
value, xrefs: 0046CBF7, 0046CFCE

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: .$value
API String ID: 4194217158-1166439862
Opcode ID: e4d2c8bf8eacc67e6997dd18ec727800c74d1e7f31625a4997ea1991802491bb
Instruction ID: 6bb52dc470a67732b65bfa6fba687dde157c2efc00668daf5dfdc611f465addf
Opcode Fuzzy Hash: e4d2c8bf8eacc67e6997dd18ec727800c74d1e7f31625a4997ea1991802491bb
Instruction Fuzzy Hash: 09328D70D01288DEDB14CFA9C9547EEBBB1AF15304F24819EE458AB382E7785B48DF52

Uniqueness

Uniqueness Score: -1.00%

Function 004F1AC4 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ea7220ccbc7587e5769382b7ad68f423b836976d9c7076096d278bdda67aec
Instruction ID: e1f0bbcd43b77d7626f4e77856158d48870e96d21c9a9c54683f95f8a13591de
Opcode Fuzzy Hash: d2ea7220ccbc7587e5769382b7ad68f423b836976d9c7076096d278bdda67aec
Instruction Fuzzy Hash: D5B15974E0424CEFDB11DF99D880BBE7BB1AF56304F14415AE6049B3A2C778AD42CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041D560 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 244libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041D79A
GetProcAddress.KERNEL32(00000000,06150005), ref: 0041D7A5
WSASend.WS2_32(0000000F,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0041D7BA

Strings

Ws2_32.dll, xrefs: 0041D791
39<, xrefs: 0041D774

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcSend
String ID: 39<$Ws2_32.dll
API String ID: 2819740048-4200987404
Opcode ID: c69c04ee7ae2295ddacff926e2ae81a183a2070aca705dce49a36a733aacb347
Instruction ID: 51d12b58568d2725e11e2f3ede4e953a1ffade967b8a63a07fe4bd30ab4072ec
Opcode Fuzzy Hash: c69c04ee7ae2295ddacff926e2ae81a183a2070aca705dce49a36a733aacb347
Instruction Fuzzy Hash: C7A179B0E00214DFCB24DF58C9447AEBBF0AF18714F18855EE869AB381D779AD81CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00414233 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 192fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 00414337
std::_Throw_Cpp_error.LIBCPMT ref: 00414482
std::_Throw_Cpp_error.LIBCPMT ref: 00414493

Strings

\, xrefs: 00414253

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$CopyFile
String ID: \
API String ID: 4177132511-2967466578
Opcode ID: d2dbee1534c5c85b3556dab985fa2ee1985f678c8ffbde03522007a8a5baf56b
Instruction ID: ec448d641316e2a3872437f4d92d0186c9a642a8506e38dff8007fdda78d9240
Opcode Fuzzy Hash: d2dbee1534c5c85b3556dab985fa2ee1985f678c8ffbde03522007a8a5baf56b
Instruction Fuzzy Hash: 8681FC70D00288DFDF04DBE4D945BEDBBB4EF15308F20429EE41067292EBB81A48DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00491300 Relevance: 6.1, APIs: 4, Instructions: 66fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 0049131F
GetLastError.KERNEL32 ref: 0049132A
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00491352
GetLastError.KERNEL32 ref: 0049135C

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLast$PointerRead
String ID:
API String ID: 2170121939-0
Opcode ID: fc66bafa82d2f8404cdf7c252faac411a51537015cb655470ecd5fc5aba69e13
Instruction ID: 0b9ab4fa7100161e3312e7656db52f40096a583a722d5ee13f2c0e10fa81db1a
Opcode Fuzzy Hash: fc66bafa82d2f8404cdf7c252faac411a51537015cb655470ecd5fc5aba69e13
Instruction Fuzzy Hash: EA114632600509EBDB108FA9EC05BDABBA8EF55371F008267FD1CC6660E775D9609BD0

Uniqueness

Uniqueness Score: -1.00%

Function 004F293D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004F2053: GetConsoleOutputCP.KERNEL32(C835321C,00000000,00000000,?), ref: 004F20B6

WriteFile.KERNELBASE(?,00000000,004E6777,?,00000000,00000000,00000000,?,00000000,?,00000000,wgN,00000000,00000000,?,?), ref: 004F2AC2
GetLastError.KERNEL32(?,004E6777,00000000,?,00000000,?,00000000,00000000), ref: 004F2ACC

Strings

wgN, xrefs: 004F293F

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID: wgN
API String ID: 2915228174-354891312
Opcode ID: c4e0fab56aaa5aa668606d57f16693d2fff82ef8988b3cb834d35c0f5d62a876
Instruction ID: 58ddb85c8bea4c2b3dbe3e5c994e5fd3db19d053895fb78a9c91e10694f9601d
Opcode Fuzzy Hash: c4e0fab56aaa5aa668606d57f16693d2fff82ef8988b3cb834d35c0f5d62a876
Instruction Fuzzy Hash: BB61A271D0011EAFDF11CFA8CA84EFEBBB9AF19304F14014AEA00A7255D3B9D906CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004F6601 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156timeCOMMON

Download Yara Rule

APIs

Part of subcall function 004F4253: RtlFreeHeap.NTDLL(00000000,00000000,?,004FAD87,004E60B3,00000000,004E60B3,?,004FB028,004E60B3,00000007,004E60B3,?,004FB51C,004E60B3,004E60B3), ref: 004F4269
Part of subcall function 004F4253: GetLastError.KERNEL32(004E60B3,?,004FAD87,004E60B3,00000000,004E60B3,?,004FB028,004E60B3,00000007,004E60B3,?,004FB51C,004E60B3,004E60B3), ref: 004F4274

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004F67B4,00000000,00000000,00000000), ref: 004F6673

Strings

W. Europe Summer Time, xrefs: 004F6720
W. Europe Standard Time, xrefs: 004F670C

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 3335090040-690618308
Opcode ID: 76eabf8b9fefbc0f82c39e30ff9c0a32debad6d34d411fa20371c7aef0a9fd2d
Instruction ID: 93f141717271661ea9db8106dfbabb38566b4f45f23fbb06abea1e9cd715a989
Opcode Fuzzy Hash: 76eabf8b9fefbc0f82c39e30ff9c0a32debad6d34d411fa20371c7aef0a9fd2d
Instruction Fuzzy Hash: 1E41FB71D00219BBCB14BF66DC459AE7BB8EF05368B11415BF610D72A1DB389E04DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004060E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 004DE42B: RaiseException.KERNEL32(E06D7363,00000001,00000003,0045DCD0,0045DCD0,?,?,004DAF37,0045DCD0,0053D744,00000000,0045DCD0,00000000,00000001), ref: 004DE48B

___std_fs_directory_iterator_open@12.LIBCPMT ref: 004061E8
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406202

Strings

absolute, xrefs: 00406116

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID: absolute
API String ID: 1297148070-2799662678
Opcode ID: 83d60d2f71de9d8f69fa5d81af5cafba3f0471d6c422f5ef9654ebbd380b6de7
Instruction ID: df52e70302dbc25e70dbc729ec55d43ed626788b5323ae355475d9aa96fec0df
Opcode Fuzzy Hash: 83d60d2f71de9d8f69fa5d81af5cafba3f0471d6c422f5ef9654ebbd380b6de7
Instruction Fuzzy Hash: 9831D071900618ABCB20EF55C945AAFBBB8FF44764F00066AE815773C1DB38AA04CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0040AC3C

Strings

qZC, xrefs: 0040AC50
1, xrefs: 0040ABA5

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID: 1$qZC
API String ID: 2638373210-4291668569
Opcode ID: e6e22c07389a48e61ae8e95e7b83de7e9b3121829484d644dc2acc3f52427005
Instruction ID: d341f4343d4f5fdecf0593ce2782d3c7c06861483f708230bb127ce9c5082770
Opcode Fuzzy Hash: e6e22c07389a48e61ae8e95e7b83de7e9b3121829484d644dc2acc3f52427005
Instruction Fuzzy Hash: 0B31C1709043459BDB20EF69C905BAFBBF4EF44704F10066EE5416B282D7B99A48CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0040B270 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00000005,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B2B5

Part of subcall function 004DBDDA: ReleaseSRWLockExclusive.KERNEL32(?,DT,0040B6FD,005444E8,?,?,\*.*,00000004), ref: 004DBDEE

std::_Throw_Cpp_error.LIBCPMT ref: 0040B2E4
std::_Throw_Cpp_error.LIBCPMT ref: 0040B2F5

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryExclusiveLockRelease
String ID:
API String ID: 1881651058-0
Opcode ID: 4aa31760ff55f9e8091e016fbf5db6d1ac4fd96c015ccc68c759aad941cf529b
Instruction ID: 2083917a30228ff47c2f58c55b42abb2321d0377fce0ac6287103c5d37e315ef
Opcode Fuzzy Hash: 4aa31760ff55f9e8091e016fbf5db6d1ac4fd96c015ccc68c759aad941cf529b
Instruction Fuzzy Hash: E0F086B5980704EBDB209B5A9D06B9A7A98E702B38F11436FF435533D0E7755A00CAEA

Uniqueness

Uniqueness Score: -1.00%

Function 004EC819 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,004EC813,?,004E1C93,?,?,C835321C,004E1C93,?), ref: 004EC82A
TerminateProcess.KERNEL32(00000000,?,004EC813,?,004E1C93,?,?,C835321C,004E1C93,?), ref: 004EC831
ExitProcess.KERNEL32 ref: 004EC843

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 570eabad1b53be2d073ee1c841cabbe5f8cdf0a80e41f99a4d5a77ab8836c315
Instruction ID: 441ef718a996dc58b5bae7a476c47dbc26188b301f5d8cdfa8241a9a43c48a8d
Opcode Fuzzy Hash: 570eabad1b53be2d073ee1c841cabbe5f8cdf0a80e41f99a4d5a77ab8836c315
Instruction Fuzzy Hash: AED05E32000544FBCF013F62DE4D8993F29BFA0347B448025B86549131DB79895AEA84

Uniqueness

Uniqueness Score: -1.00%

Function 004786F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0047887E

Strings

WF, xrefs: 00478718, 004787F4, 004787AF, 00478773, 004787E0, 004787FA

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: WF
API String ID: 118556049-3269146837
Opcode ID: 0d3fff30ff6584a27bed6aa9a994ba9ba84eddafc1fa4227622810e2c2b696b2
Instruction ID: 3ab1529a9723302c1f437a0db943357650608c6a53bfd2449bd8fed2b14d66f4
Opcode Fuzzy Hash: 0d3fff30ff6584a27bed6aa9a994ba9ba84eddafc1fa4227622810e2c2b696b2
Instruction Fuzzy Hash: 0D41D571A001158FCB18DF6DC9859AEBBB9EB84350B24822FE819DB385DB74DD01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0043E990 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0043E9E1

Strings

"6, xrefs: 0043EB5F

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: "6
API String ID: 1514166925-701612358
Opcode ID: b949de36dffe6a65c5d71fce7b12989b39bf068e0a56ac47bc333a1a6a49265b
Instruction ID: 7f6c3857031e9ecd41295e242b3f508b67c493e0e27127d8f4aabd3770d547c9
Opcode Fuzzy Hash: b949de36dffe6a65c5d71fce7b12989b39bf068e0a56ac47bc333a1a6a49265b
Instruction Fuzzy Hash: 09512970C04298CAEB15DF64C948BEDB770BF16304F1082DDD4896B2C2DBB51A89CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00463650 Relevance: 3.2, APIs: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004637EB
__fread_nolock.LIBCMT ref: 0046380D

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: ec22e4f50313ced31549da422d7a857b29f27fbc93b2f98bdcf651741bea44c0
Instruction ID: 79d947a9d222d8f0fc42436fae4463b375b8f25b2523b1e7cbdb0ad83c72afb4
Opcode Fuzzy Hash: ec22e4f50313ced31549da422d7a857b29f27fbc93b2f98bdcf651741bea44c0
Instruction Fuzzy Hash: FE618A766042459FCB14CF2DD88096AB7E1EF84325F0486AAFC18CB355EB35DD18CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004144E0 Relevance: 3.1, APIs: 2, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00414675
std::_Throw_Cpp_error.LIBCPMT ref: 00414686

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: ac862eee7d6d7ce6c3a12efbee1ba40941964af439277532c0956238cae26ce1
Instruction ID: d0c1233a766ed38641b4c07237d350fd222a008ab52e14fa55b74dcab28789ba
Opcode Fuzzy Hash: ac862eee7d6d7ce6c3a12efbee1ba40941964af439277532c0956238cae26ce1
Instruction Fuzzy Hash: BB411375E00205CBCB24DF6CD8017AEB7B2FB91708F05062EE815A7392DB78A984DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00406150 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 004061E8
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406202

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID:
API String ID: 3016148460-0
Opcode ID: 199b10b5cbcfc3bac638bdf402b44041a05770ed40428cdac618f3dde5b17595
Instruction ID: d4caf346f189b166542986bb95bd81797666f76ba9d979eef76578570dd901e2
Opcode Fuzzy Hash: 199b10b5cbcfc3bac638bdf402b44041a05770ed40428cdac618f3dde5b17595
Instruction Fuzzy Hash: 1D31D072A00618ABCB24EF49D851BAEB7B4EF84764F01066FEC1663780DB396D14CAD4

Uniqueness

Uniqueness Score: -1.00%

Function 004EB74C Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,0053DB98,00000000,00000002,00000000,00000000,?,?,?,004EB856,00000000,?,00000000,00000002,0053DB98), ref: 004EB788
GetLastError.KERNEL32(00000000,?,?,?,004EB856,00000000,?,00000000,00000002,0053DB98,00000000,00000000,00000000,0053DB98,0000000C,004E684E), ref: 004EB795

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 67635d8b729ae6903c65b0b30b5db55b4f67fedfa01514e4e7d532381152a944
Instruction ID: 384096725cce8be96e4ab00bbb6ce162e331f1cfeb537b4fcb45676fe5c1bc8b
Opcode Fuzzy Hash: 67635d8b729ae6903c65b0b30b5db55b4f67fedfa01514e4e7d532381152a944
Instruction Fuzzy Hash: 09014836210159AFCF058F6ACC0589F3B29EFC5321B240209F8109B2A0E734ED428BD0

Uniqueness

Uniqueness Score: -1.00%

Function 004F4253 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,004FAD87,004E60B3,00000000,004E60B3,?,004FB028,004E60B3,00000007,004E60B3,?,004FB51C,004E60B3,004E60B3), ref: 004F4269
GetLastError.KERNEL32(004E60B3,?,004FAD87,004E60B3,00000000,004E60B3,?,004FB028,004E60B3,00000007,004E60B3,?,004FB51C,004E60B3,004E60B3), ref: 004F4274

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8b73b785357b2346bfa9b41464cc3ad5fe5b38bc98d19c64144e2217278180d9
Instruction ID: ea2134de0cf5f8181c31f49d7920a3ecd8334c799a4adc26afd63096a676bfd3
Opcode Fuzzy Hash: 8b73b785357b2346bfa9b41464cc3ad5fe5b38bc98d19c64144e2217278180d9
Instruction Fuzzy Hash: 62E08632100614A7CB112BA5AC0C7DE3F98AF80395F028476F60C86160EA3898649798

Uniqueness

Uniqueness Score: -1.00%

Function 004E2032 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca496ef47f0e7f3bd31ff4d0c6dd67ba7ae3da1b984ba6e74bea7cea9b832298
Instruction ID: a945f24e44b28e743e936d21751d2e95920c4c00ec505ba9b30c130e86fbcea3
Opcode Fuzzy Hash: ca496ef47f0e7f3bd31ff4d0c6dd67ba7ae3da1b984ba6e74bea7cea9b832298
Instruction Fuzzy Hash: 6151F670A00284AFDF14CF5ACD81AAABFB5EF45315F24815AF9085B352C3B5DE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004F42CD Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,004F9713,4D88C033,?,004F9713,00000220,?,004F2C8F,4D88C033), ref: 004F42FF

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2198638593cbac858731316a311480fbe239b50477190752b525c17ad8c2d171
Instruction ID: 89252cde3629954a7dd651662e79814aadfa885b8aeb937b2ffe9774318fd193
Opcode Fuzzy Hash: 2198638593cbac858731316a311480fbe239b50477190752b525c17ad8c2d171
Instruction Fuzzy Hash: 23E0A02530421896D63126AA9C04BBB3A489BC23B8F160167BF0596291DF2CCC0181FE

Uniqueness

Uniqueness Score: -1.00%

Function 004EF889 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004EF890

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 642ab808bc47696ae728f0514146959be3b190675648a466094860987fb1a248
Instruction ID: 6774f2ffb1e86b77a5a3f95ea0b65f3d51a0f57c6d64d54c353970c0c04ae7a7
Opcode Fuzzy Hash: 642ab808bc47696ae728f0514146959be3b190675648a466094860987fb1a248
Instruction Fuzzy Hash: 66E09AB6C0020DAADB00DFD5C452BEFBBFCAB08304F50412BA205E7141EA7857858BE1

Uniqueness

Uniqueness Score: -1.00%

Function 0043CA61 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(6C3B0000), ref: 0043CA73

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 1b817b431e1bcb8b8660f8d52eba7c158e344ec8198f08c13cc3c16a208e3d83
Instruction ID: c2aff94c4f18faa8c51ba634006d0e3fc72a7f72d38d24f3f513cb8b6753d3b2
Opcode Fuzzy Hash: 1b817b431e1bcb8b8660f8d52eba7c158e344ec8198f08c13cc3c16a208e3d83
Instruction Fuzzy Hash: 9EC0805844C7C19BD70283704C0C3DEFF547B37308F8800879544D5196F27CC018D611

Uniqueness

Uniqueness Score: -1.00%

Function 0043CA60 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(6C3B0000), ref: 0043CA73

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: f8c40282056245796d7f5b5903a6d79a5f33a872c032442f370485422ea39e21
Instruction ID: 6f1538f3c83fda123e057c8c8b71c8c1581e6641b9bb3c2eae2c166c88091a8e
Opcode Fuzzy Hash: f8c40282056245796d7f5b5903a6d79a5f33a872c032442f370485422ea39e21
Instruction Fuzzy Hash: 47C01228184381AAE702D774AC4C39B3AA8732B308F485046A548AA2A0C2388818EB60

Uniqueness

Uniqueness Score: -1.00%

Function 0041E750 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000065,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041E7C7

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f7a3327ab82349f100f1f42aa0b0e5cff60294bd63498b5a51e33dd0a22f8d9f
Instruction ID: 79f0e9190b931bb93153a42b520cda6f2ad0e539c83b0fe0ba77e5d034c095ba
Opcode Fuzzy Hash: f7a3327ab82349f100f1f42aa0b0e5cff60294bd63498b5a51e33dd0a22f8d9f
Instruction Fuzzy Hash: E8012079E44684ABD710AF599C0ABAE7B54E741B38F14025FF5241B7C1D7781C058BCA

Uniqueness

Uniqueness Score: -1.00%

Function 0041E7F0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000065,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041E867

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6dd91079ba1ef193910dc124d04d20246a629cc08a20c6bb60a5610a652488b0
Instruction ID: 495735fe8f5a63119b41650622d5438b130c097a16836f37a533a087ee5ee12b
Opcode Fuzzy Hash: 6dd91079ba1ef193910dc124d04d20246a629cc08a20c6bb60a5610a652488b0
Instruction Fuzzy Hash: 80017BB5E40684ABD710AB5A8C06BAE7BA6E742B28F14024EF5141B3C1D7B8180087C9

Uniqueness

Uniqueness Score: -1.00%

Function 0041E890 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041E907

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6ae5d539560427b4273ddbb2323bd143869bb8717069fdd20952c7c124a300a7
Instruction ID: 856fd3f3b6c9bdd6e77d2204c72a8a86155eda9e7d346db51e80ac84defc7b96
Opcode Fuzzy Hash: 6ae5d539560427b4273ddbb2323bd143869bb8717069fdd20952c7c124a300a7
Instruction Fuzzy Hash: D00120B6E44684ABD720EB599C0ABAE7B54E741B28F14024EF5141B3C1D7791844D7C6

Uniqueness

Uniqueness Score: -1.00%

Function 0041E930 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041E9A7

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1dd3132a831f6b3fdc37602cddac998eaa2dfe8dc3bc418b2e161be17c3cae3a
Instruction ID: 4d51e3cdc561a834d510c8c3ef11e1b4b22122f6eac1103c18ef6d6a89a62e8d
Opcode Fuzzy Hash: 1dd3132a831f6b3fdc37602cddac998eaa2dfe8dc3bc418b2e161be17c3cae3a
Instruction Fuzzy Hash: 310120B6E54644ABD7209B599C06BEE7B64E741B28F14024EF5181B3C1D77818448BC5

Uniqueness

Uniqueness Score: -1.00%

Function 0041E9D0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000065,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041EA47

Memory Dump Source

Source File: 00000000.00000002.2254819923.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d6de9ebc316f42d030ed6e88b55143bd222477d6e94bd323caeb6c642de71256
Instruction ID: 8197e4f2a7925b8cf845a2034c93b7373f5ae7c38e82d9b16ca3c881090597ec
Opcode Fuzzy Hash: d6de9ebc316f42d030ed6e88b55143bd222477d6e94bd323caeb6c642de71256
Instruction Fuzzy Hash: 22017B75E44784AFD710EB49DC06BAEBBA4EB51B28F04024EF5241B7C1D7B8184487C5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_3b166e6571299cee7343626b59f7d7bbe157b8c9_45086259_c58001ed-2ce3-4e1e-9019-867a112921c2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_3b166e6571299cee7343626b59f7d7bbe157b8c9_45086259_ccde6796-0630-43ad-93e5-81a73d475583\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_3b166e6571299cee7343626b59f7d7bbe157b8c9_45086259_dfa15fe3-4273-4d5b-97f7-438a6adc3f79\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4594c263b2b2fddaf2855c7efb1b922584ccf4c_804fa867_cf5d468c-292b-40ba-84bc-75df7a1336d9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4594c263b2b2fddaf2855c7efb1b922584ccf4c_804fa867_fb3b76dc-3723-4c12-95a8-3eb742cb3382\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_1bea40c6-29f2-46a6-b131-6f75278ec17c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_7468fa83-67cd-459b-9cbc-4c12e81c893a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_8b113e4e-2225-4b05-80d3-ff5f486a2ef9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_aa9cc303-3ec6-47f1-8d50-17d31237829f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_b150831a-ad0d-4b32-98f8-831394925195\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_b8d96110-c9fb-424d-a33b-5f55f8d8ed4e\Report.wer

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre