Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1429092
MD5:	a815d2d73a30dfcab21000b326b29c13
SHA1:	b9ec12b977b9ee6ecdcb74c7e718ad4018755625
SHA256:	9ba89a594158dcad47219d1fffc94d54ceab08aa934dfaf80a9880fefd3e3070
Tags:	exe
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

Connects to many ports of the same IP (likely port scanning)

Contains functionality to check for running processes (XOR)

Contains functionality to inject threads in other processes

Country aware sample found (crashes after keyboard check)

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7448 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A815D2D73A30DFCAB21000B326B29C13)

schtasks.exe (PID: 7492 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7540 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7660 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 848 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7820 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 960 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7880 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 972 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7940 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 976 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8052 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 976 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8132 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 1396 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8188 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 996 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 7548 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: A815D2D73A30DFCAB21000B326B29C13)

WerFault.exe (PID: 7756 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 808 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2912 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 920 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7336 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 908 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7652 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 936 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7752 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 936 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 7716 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: A815D2D73A30DFCAB21000B326B29C13)

WerFault.exe (PID: 8004 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 776 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7036 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 888 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7440 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 884 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7672 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 900 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7252 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 908 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\rTXApvaKL9yw6N5oqHITZ9U.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\HZqMYfpyMfdfHfQja15Vpq6.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\ax62Lo_zBXq90uwBqgwbr3X.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2374176971.0000000006728000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000004.00000002.2371863766.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000004.00000002.2373416291.0000000003707000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2081219970.000000000370D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000002.2305457236.00000000035A1000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000003.1684180987.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2304201006.0000000000400000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2306103257.0000000006730000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2081934645.0000000006720000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2370794973.0000000000400000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1666330206.00000000039F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000009.00000003.1705537281.0000000003990000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: file.exe PID: 7448	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: file.exe PID: 7448	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7548	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7548	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7716	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7716	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.MPGPH131.exe.400000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
9.2.MPGPH131.exe.3830e67.1.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
4.2.MPGPH131.exe.38e0e67.1.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
4.2.MPGPH131.exe.400000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0.2.file.exe.400000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
4.3.MPGPH131.exe.3a40000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
9.2.MPGPH131.exe.400000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0.2.file.exe.400000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0.3.file.exe.39f0000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
9.3.MPGPH131.exe.3990000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0.2.file.exe.3890e67.1.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
4.2.MPGPH131.exe.400000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 7448, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/20/24-20:05:38.687787
SID:	2046269
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/20/24-20:05:02.409597
SID:	2046267
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/20/24-20:05:01.031788
SID:	2046266
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/20/24-20:05:05.549113
SID:	2046269
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/20/24-20:05:58.481493
SID:	2046269
Source Port:	49745
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/20/24-20:05:00.821645
SID:	2049060
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/20/24-20:05:05.669470
SID:	2046266
Source Port:	58709
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/20/24-20:05:03.174322
SID:	2046266
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/20/24-20:05:08.957422
SID:	2046267
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/20/24-20:05:09.034376
SID:	2046267
Source Port:	58709
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/20/24-20:05:54.187156
SID:	2046269
Source Port:	49744
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/20/24-20:05:24.937277
SID:	2046266
Source Port:	58709
Destination Port:	49745
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/20/24-20:05:41.718793
SID:	2046269
Source Port:	49732
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/20/24-20:05:19.057028
SID:	2046266
Source Port:	58709
Destination Port:	49744
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/20/24-20:05:25.800661
SID:	2046267
Source Port:	58709
Destination Port:	49744
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/20/24-20:05:36.860964
SID:	2046267
Source Port:	58709
Destination Port:	49745
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://193.233.132.167/cost/lenin.exe

URL Reputation: Label: malware

Multi AV Scanner detection for domain / URL

Source: http://147.45.47.102:57893/hera/amadka.exe	Virustotal: Detection: 18%	Perma Link
Source: http://193.233.132.167/cost/go.exe	Virustotal: Detection: 24%	Perma Link
Source: http://193.233.132.167/cost/lenin.exeUser	Virustotal: Detection: 23%	Perma Link
Source: http://193.233.132.167/cost/go.exelater	Virustotal: Detection: 23%	Perma Link
Source: http://147.45.47.102:57893/hera/amadka.exe68.0	Virustotal: Detection: 15%	Perma Link
Source: http://193.233.132.167/cost/go.exe/	Virustotal: Detection: 24%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 36%
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Virustotal: Detection: 44%	Perma Link
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Virustotal: Detection: 44%	Perma Link
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 36%

Machine Learning detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041F3EB CryptUnprotectData,LocalFree,		0_2_0041F3EB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0041F3EB CryptUnprotectData,LocalFree,		4_2_0041F3EB

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 4.2.MPGPH131.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49756 version: TLS 1.2

Source:

Binary string: C:\marahakogori-butukewu_zovo.pdb source: file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E7B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	0_2_0040E7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DB1CB FindClose,FindFirstFileExW,GetLastError,	0_2_004DB1CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040B300 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_0040B300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041FA10 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_0041FA10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0040E7B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	4_2_0040E7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004DB1CB FindClose,FindFirstFileExW,GetLastError,	4_2_004DB1CB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0040B300 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	4_2_0040B300
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0041FA10 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	4_2_0041FA10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0043EAEB FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CopyFileA,CopyFileA,	4_2_0043EAEB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004DB251 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	4_2_004DB251
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0043FBB9 FindFirstFileA,FindNextFileA,GetLastError,FindClose,CreateFileA,GetFileSize,ReadFile,CloseHandle,	4_2_0043FBB9

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_30d4bf65-0144-4d41-a1e5-2d1f034d6932\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_236d6df2-efc0-4d22-90e1-905525e0d691\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49730 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49730 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49731 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49732 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49744
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49744 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49745
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49744
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49745 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49745

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 147.45.47.93:58709

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 147.45.47.93 147.45.47.93
Source: Joe Sandbox View	IP Address: 104.26.4.15 104.26.4.15

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041E220 recv,setsockopt,recv,WSAGetLastError,recv,recv,setsockopt,recv,recv,recv,__Xtime_get_ticks,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,Sleep,Sleep,

0_2_0041E220

Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown

DNS traffic detected: queries for: ipinfo.io

Source: file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe68.0
Source: file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exef
Source: file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe/
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001CF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exeIdser
Source: file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exelater
Source: file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exeoin7FwmBKlOFG
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exeomanialisherQ
Source: file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe.exeData.
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe81.57.52
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001CF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exeUser
Source: file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exeania
Source: file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exeerty.jaxx
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, file.exe, 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1666330206.00000000039F0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000004.00000003.1684180987.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2370794973.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2304201006.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.1705537281.0000000003990000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: file.exe, 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1666330206.00000000039F0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.1684180987.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2370794973.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2304201006.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.1705537281.0000000003990000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllDpRTpR
Source: file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/0
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52l
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52o
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52u_
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52
Source: file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52d
Source: file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C41000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: file.exe, 00000000.00000002.2080428663.0000000001B5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/=R
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/M2_&
Source: file.exe, 00000000.00000002.2080428663.0000000001B8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: file.exe, 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1666330206.00000000039F0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.1684180987.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2370794973.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2304201006.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.1705537281.0000000003990000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: file.exe, 00000000.00000002.2080428663.0000000001B8A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2080428663.0000000001B5E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B5C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52b
Source: file.exe, 00000000.00000002.2080428663.0000000001B5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52ey
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52u
Source: file.exe, 00000000.00000002.2080428663.0000000001B8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1863448564.0000000006793000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213504678.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2102868244.00000000067A3000.00000004.00000020.00020000.00000000.sdmp, 8MhogtJMRILwHistory.0.dr, sANT26gQMwt7History.4.dr, fzOGBVhWIKhlHistory.4.dr, uUNSZzd9cNCaHistory.9.dr, Sbg9DSp7lstNHistory.0.dr, Z2XBcxuCaxhxHistory.9.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 8MhogtJMRILwHistory.0.dr, sANT26gQMwt7History.4.dr, fzOGBVhWIKhlHistory.4.dr, uUNSZzd9cNCaHistory.9.dr, Sbg9DSp7lstNHistory.0.dr, Z2XBcxuCaxhxHistory.9.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1863448564.0000000006793000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213504678.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2102868244.00000000067A3000.00000004.00000020.00020000.00000000.sdmp, 8MhogtJMRILwHistory.0.dr, sANT26gQMwt7History.4.dr, fzOGBVhWIKhlHistory.4.dr, uUNSZzd9cNCaHistory.9.dr, Sbg9DSp7lstNHistory.0.dr, Z2XBcxuCaxhxHistory.9.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 8MhogtJMRILwHistory.0.dr, sANT26gQMwt7History.4.dr, fzOGBVhWIKhlHistory.4.dr, uUNSZzd9cNCaHistory.9.dr, Sbg9DSp7lstNHistory.0.dr, Z2XBcxuCaxhxHistory.9.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.S
Source: file.exe, 00000000.00000002.2080428663.0000000001B0E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081934645.0000000006720000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2374176971.0000000006728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C07000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2306103257.0000000006730000.00000004.00000020.00020000.00000000.sdmp, rTXApvaKL9yw6N5oqHITZ9U.zip.4.dr, HZqMYfpyMfdfHfQja15Vpq6.zip.0.dr, ax62Lo_zBXq90uwBqgwbr3X.zip.9.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT0o
Source: MPGPH131.exe, 00000004.00000002.2374176971.0000000006728000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTa
Source: MPGPH131.exe, 00000009.00000002.2306103257.0000000006730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTs
Source: MPGPH131.exe, 00000009.00000002.2306103257.0000000006730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT~
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2240485249.00000000067AD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2306103257.0000000006730000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.9.dr, passwords.txt.0.dr, passwords.txt.4.dr	String found in binary or memory: https://t.me/risepro_bot
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_both
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlaterT
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botriseproon1
Source: file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/(
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/:
Source: file.exe, 00000000.00000003.1862531122.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1862749156.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863180370.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864385278.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863589514.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863761310.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864172189.000000000676E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2374176971.000000000675E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2306103257.000000000676A000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.4.dr, 3b6N2Xdh3CYwplaces.sqlite.9.dr, D87fZN3R3jFeplaces.sqlite.4.dr, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/r6GX4f
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/e3
Source: file.exe, 00000000.00000003.1862531122.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1862749156.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863180370.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864385278.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863589514.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863761310.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864172189.000000000676E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2374176971.000000000675E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2306103257.000000000676A000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.4.dr, 3b6N2Xdh3CYwplaces.sqlite.9.dr, D87fZN3R3jFeplaces.sqlite.4.dr, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/her.dbuG
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001CF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/r
Source: file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox1

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49756 version: TLS 1.2

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: 4_2_0040BAC0 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,DeleteObject,GdipDisposeImage,DeleteObject,ReleaseDC,GdiplusShutdown,

4_2_0040BAC0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000004.00000002.2373416291.0000000003707000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2081219970.000000000370D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.2305457236.00000000035A1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00446020	0_2_00446020
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044C160	0_2_0044C160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00428180	0_2_00428180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00496450	0_2_00496450
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406430	0_2_00406430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004224D9	0_2_004224D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C490	0_2_0040C490
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045A490	0_2_0045A490
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004564A0	0_2_004564A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048C560	0_2_0048C560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00458520	0_2_00458520
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00438770	0_2_00438770
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00424730	0_2_00424730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E7B0	0_2_0040E7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043C800	0_2_0043C800
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044A8F0	0_2_0044A8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00442940	0_2_00442940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042C980	0_2_0042C980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043CA90	0_2_0043CA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00434B20	0_2_00434B20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042EB90	0_2_0042EB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045CC40	0_2_0045CC40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00440C10	0_2_00440C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040CD50	0_2_0040CD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00490E40	0_2_00490E40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E925D	0_2_004E925D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048D250	0_2_0048D250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CB3C0	0_2_004CB3C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00431430	0_2_00431430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045B4B0	0_2_0045B4B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043B65D	0_2_0043B65D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00423670	0_2_00423670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042B670	0_2_0042B670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004176B0	0_2_004176B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043B750	0_2_0043B750
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004378A0	0_2_004378A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00431BE0	0_2_00431BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045DDE5	0_2_0045DDE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041FF09	0_2_0041FF09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BFC0	0_2_0040BFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048BFB0	0_2_0048BFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048E040	0_2_0048E040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049A160	0_2_0049A160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00490100	0_2_00490100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D02E0	0_2_004D02E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004202AA	0_2_004202AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048E35B	0_2_0048E35B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00422360	0_2_00422360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D4310	0_2_004D4310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E03D0	0_2_004E03D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402410	0_2_00402410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004944E0	0_2_004944E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00416490	0_2_00416490
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402600	0_2_00402600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00484620	0_2_00484620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00422852	0_2_00422852
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00490860	0_2_00490860
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00446020	4_2_00446020
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00428180	4_2_00428180
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00496450	4_2_00496450
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00406430	4_2_00406430
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004224D9	4_2_004224D9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0040C490	4_2_0040C490
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045A490	4_2_0045A490
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004564A0	4_2_004564A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0048C560	4_2_0048C560
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00458520	4_2_00458520
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00402600	4_2_00402600
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00438770	4_2_00438770
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00424730	4_2_00424730
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0040E7B0	4_2_0040E7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0043C800	4_2_0043C800
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0044A8F0	4_2_0044A8F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00442940	4_2_00442940
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0042C980	4_2_0042C980
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0043CA90	4_2_0043CA90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00434B20	4_2_00434B20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0042EB90	4_2_0042EB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045CC40	4_2_0045CC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00440C10	4_2_00440C10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0040CD50	4_2_0040CD50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004E925D	4_2_004E925D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0048D250	4_2_0048D250
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004CB3C0	4_2_004CB3C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00431430	4_2_00431430
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045B4B0	4_2_0045B4B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0043B65D	4_2_0043B65D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00423670	4_2_00423670
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0042B670	4_2_0042B670
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004176B0	4_2_004176B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0043B750	4_2_0043B750
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004378A0	4_2_004378A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00431BE0	4_2_00431BE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045DDE5	4_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0041FF09	4_2_0041FF09
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0040BFC0	4_2_0040BFC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0048BFB0	4_2_0048BFB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0048E040	4_2_0048E040
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0044C160	4_2_0044C160
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0049A160	4_2_0049A160
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00490100	4_2_00490100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004D02E0	4_2_004D02E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004202AA	4_2_004202AA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0048E35B	4_2_0048E35B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00422360	4_2_00422360
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004D4310	4_2_004D4310
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004E03D0	4_2_004E03D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00402410	4_2_00402410
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004944E0	4_2_004944E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00416490	4_2_00416490
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00484620	4_2_00484620
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00422852	4_2_00422852
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00490860	4_2_00490860
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0043EAEB	4_2_0043EAEB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004D2A90	4_2_004D2A90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00486AA0	4_2_00486AA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004D0B30	4_2_004D0B30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0044EB90	4_2_0044EB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004F6CC5	4_2_004F6CC5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0048ECA2	4_2_0048ECA2
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0048CD80	4_2_0048CD80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00490E40	4_2_00490E40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0049EE70	4_2_0049EE70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0049AE20	4_2_0049AE20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414ED0	4_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00418EE0	4_2_00418EE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00482FE0	4_2_00482FE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00440FF5	4_2_00440FF5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0048D020	4_2_0048D020
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004CD080	4_2_004CD080
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00487270	4_2_00487270
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0047F360	4_2_0047F360
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00483470	4_2_00483470
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0048B4F0	4_2_0048B4F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004E959F	4_2_004E959F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004A36EE	4_2_004A36EE
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00433740	4_2_00433740
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00489720	4_2_00489720
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004497D0	4_2_004497D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0048F7B0	4_2_0048F7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004B5870	4_2_004B5870
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00401900	4_2_00401900
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004BB9E0	4_2_004BB9E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004FD9FE	4_2_004FD9FE
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004099A0	4_2_004099A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00481A30	4_2_00481A30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004E3B58	4_2_004E3B58
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004E5B90	4_2_004E5B90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0048BC00	4_2_0048BC00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00409D90	4_2_00409D90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004D1E50	4_2_004D1E50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00483EF0	4_2_00483EF0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0043FF40	4_2_0043FF40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0043FF13	4_2_0043FF13

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00402D00 appears 36 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0046A190 appears 75 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0048FE50 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00469F00 appears 46 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 004DD5B0 appears 54 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0048FE50 appears 90 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 00469F00 appears 58 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 004622E0 appears 35 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 00402D00 appears 42 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0046A190 appears 109 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 848

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewpa.dll( vs file.exe
Source: file.exe, 00000000.00000002.2080367579.0000000001A9B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires0 vs file.exe
Source: file.exe, 00000000.00000003.1693943431.0000000001B79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires0 vs file.exe
Source: file.exe, 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewpa.dll( vs file.exe
Source: file.exe, 00000000.00000003.1666330206.00000000039F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewpa.dll( vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameFires0 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000004.00000002.2373416291.0000000003707000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2081219970.000000000370D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.2305457236.00000000035A1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@26/137@2/3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00492300 GetLastError,GetVersionExA,FormatMessageW,LocalFree,FormatMessageA,

0_2_00492300

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00491D10 CreateFileW,CreateFileA,GetDiskFreeSpaceW,GetDiskFreeSpaceA,

0_2_00491D10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040CD50 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

0_2_0040CD50

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00446020 CopyFileA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,CopyFileA,GetUserNameA,CopyFileA,SHGetFolderPathA,CoInitialize,CoCreateInstance,MultiByteToWideChar,CoUninitialize,ShellExecuteA,

0_2_00446020

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7716
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7448
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7548

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1666330206.00000000039F0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000004.00000003.1684180987.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2370794973.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2304201006.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.1705537281.0000000003990000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1666330206.00000000039F0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.1684180987.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2370794973.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2304201006.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.1705537281.0000000003990000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: MPGPH131.exe, 00000004.00000003.2213026223.0000000001C02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2212582031.0000000001C02000.00000004.00000020.00020000.00000000.sdmp, W5ItwnbOEWbrLogin Data.0.dr, tTQUAdIiirY8Login Data For Account.4.dr, CEYAAajxdr9QLogin Data.4.dr, Bu4fqjuvymtRLogin Data.9.dr, IO6Zwb2pZcpALogin Data For Account.0.dr, 1xsvu65yyJa4Login Data For Account.9.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 848
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 808
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 960
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 972
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 976
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 776
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 976
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 1396
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 996
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 920
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 888
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 908
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 884
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 936
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 900
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 936
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 908
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msimg32.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msvcr100.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\marahakogori-butukewu_zovo.pdb source: file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 4.2.MPGPH131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 4.2.MPGPH131.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack

Contains functionality to check for running processes (XOR)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,Process32Next,CloseHandle,

4_2_00409D90

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0045DDE5 LoadLibraryA,GetProcAddress,MessageBoxA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetProcessId,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetThreadExecutionState,SetThreadExecutionState,SetThreadExecutionState,

0_2_0045DDE5

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004C112B push ecx; iretd		4_2_004C112C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004DD189 push ecx; ret		4_2_004DD19C

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: 4_2_00482FE0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_00482FE0

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Country aware sample found (crashes after keyboard check)

Source: c:\users\user\desktop\file.exe

Event Logs and Signature results: Application crash and keyboard check

Found API chain indicative of sandbox detection

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Sandbox detection routine: GetCursorPos, DecisionNode, Sleep
Source: C:\Users\user\Desktop\file.exe	Sandbox detection routine: GetCursorPos, DecisionNode, Sleep			graph_0-51173

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_0-47445
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_0-47675

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\file.exe	Stalling execution: Execution stalls by calling Sleep			graph_0-47452
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Stalling execution: Execution stalls by calling Sleep

Source: C:\Users\user\Desktop\file.exe	Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,		0_2_0045D9F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,		4_2_0045D9F0

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Source: C:\Users\user\Desktop\file.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-47575

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\file.exe TID: 7452	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7552	Thread sleep count: 70 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7552	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7552	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7720	Thread sleep count: 76 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7720	Thread sleep count: 36 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00464270 GetKeyboardLayoutList followed by cmp: cmp esi, edi and CTI: je 00464293h	0_2_00464270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004624B0 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 004624C0h country: Upper Sorbian (hsb)	0_2_004624B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00464270 GetKeyboardLayoutList followed by cmp: cmp esi, edi and CTI: je 00464293h	4_2_00464270
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004624B0 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 004624C0h country: Upper Sorbian (hsb)	4_2_004624B0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00492190 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 004921D1h		0_2_00492190
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00492190 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 004921D1h		4_2_00492190

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E7B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	0_2_0040E7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DB1CB FindClose,FindFirstFileExW,GetLastError,	0_2_004DB1CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040B300 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_0040B300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041FA10 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_0041FA10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0040E7B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	4_2_0040E7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004DB1CB FindClose,FindFirstFileExW,GetLastError,	4_2_004DB1CB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0040B300 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	4_2_0040B300
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0041FA10 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	4_2_0041FA10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0043EAEB FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CopyFileA,CopyFileA,	4_2_0043EAEB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004DB251 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	4_2_004DB251
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0043FBB9 FindFirstFileA,FindNextFileA,GetLastError,FindClose,CreateFileA,GetFileSize,ReadFile,CloseHandle,	4_2_0043FBB9

Source: C:\Users\user\Desktop\file.exe

0_2_0040CD50

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_30d4bf65-0144-4d41-a1e5-2d1f034d6932\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_236d6df2-efc0-4d22-90e1-905525e0d691\

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: MPGPH131.exe, 00000004.00000003.1715351136.0000000001B83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}G
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2080428663.0000000001B5E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B6B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: MPGPH131.exe, 00000004.00000003.1715351136.0000000001B81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: MPGPH131.exe, 00000004.00000003.2354415982.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}I;n%
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}f
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MPGPH131.exe, 00000004.00000003.2322806640.000000000677E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: MPGPH131.exe, 00000009.00000003.1740360087.0000000001C68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}r
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_731AF5E4m.
Source: MPGPH131.exe, 00000004.00000003.2322806640.000000000677E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_731AF5E49
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: MPGPH131.exe, 00000009.00000003.1740360087.0000000001C68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MPGPH131.exe, 00000009.00000002.2306103257.000000000676A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows~
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}%
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_731AF5E4
Source: MPGPH131.exe, 00000009.00000002.2305000838.0000000001C00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&P
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: file.exe, 00000000.00000002.2082090901.0000000006780000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}J6HEdjEHUub5EtqTQ2dk3wwrCNfruTWZeEqONRrqgXAW0ke6pZXg==_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=*

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00414870 IsDebuggerPresent,

0_2_00414870

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0045E5D4 CreateThread,FindCloseChangeNotification,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,OutputDebugStringA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

0_2_0045E5D4

Source: C:\Users\user\Desktop\file.exe

0_2_0045DDE5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004160B0 mov ecx, dword ptr fs:[00000030h]	0_2_004160B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045E5D4 mov eax, dword ptr fs:[00000030h]	0_2_0045E5D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045E5D4 mov ecx, dword ptr fs:[00000030h]	0_2_0045E5D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043CA90 mov eax, dword ptr fs:[00000030h]	0_2_0043CA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041AB90 mov eax, dword ptr fs:[00000030h]	0_2_0041AB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	0_2_0045D9F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	0_2_0045D9F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	0_2_0045DDE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	0_2_0045DDE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	0_2_0045DDE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	0_2_0045DDE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041AB90 mov eax, dword ptr fs:[00000030h]	0_2_0041AB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041AB90 mov eax, dword ptr fs:[00000030h]	0_2_0041AB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414870 mov eax, dword ptr fs:[00000030h]	0_2_00414870
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045E5D4 mov eax, dword ptr fs:[00000030h]	4_2_0045E5D4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045E5D4 mov ecx, dword ptr fs:[00000030h]	4_2_0045E5D4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0043CA90 mov eax, dword ptr fs:[00000030h]	4_2_0043CA90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045EA9C mov eax, dword ptr fs:[00000030h]	4_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0041AB90 mov eax, dword ptr fs:[00000030h]	4_2_0041AB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	4_2_0045D9F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	4_2_0045D9F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	4_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	4_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	4_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	4_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0041AB90 mov eax, dword ptr fs:[00000030h]	4_2_0041AB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004160B0 mov ecx, dword ptr fs:[00000030h]	4_2_004160B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0041AB90 mov eax, dword ptr fs:[00000030h]	4_2_0041AB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414870 mov eax, dword ptr fs:[00000030h]	4_2_00414870
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414ED0 mov eax, dword ptr fs:[00000030h]	4_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414ED0 mov eax, dword ptr fs:[00000030h]	4_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414ED0 mov eax, dword ptr fs:[00000030h]	4_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414ED0 mov eax, dword ptr fs:[00000030h]	4_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414ED0 mov eax, dword ptr fs:[00000030h]	4_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414ED0 mov eax, dword ptr fs:[00000030h]	4_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414ED0 mov eax, dword ptr fs:[00000030h]	4_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414ED0 mov eax, dword ptr fs:[00000030h]	4_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414ED0 mov eax, dword ptr fs:[00000030h]	4_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414ED0 mov eax, dword ptr fs:[00000030h]	4_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414ED0 mov eax, dword ptr fs:[00000030h]	4_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_00414ED0 mov eax, dword ptr fs:[00000030h]	4_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0041AB90 mov eax, dword ptr fs:[00000030h]	4_2_0041AB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0041EF10 mov eax, dword ptr fs:[00000030h]	4_2_0041EF10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_0041AB90 mov eax, dword ptr fs:[00000030h]	4_2_0041AB90

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: 4_2_00482C80 GetProcessHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

4_2_00482C80

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004DD3B4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004DD3B4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004DD74D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_004DD74D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 4_2_004E1C94 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004E1C94

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: 4_2_00418BB0 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

4_2_00418BB0

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: 4_2_004149F0 cpuid

4_2_004149F0

Source: C:\Users\user\Desktop\file.exe	Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_0040CD50
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_004FC045
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_004FC090
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_004FC12B
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_004FC1B6
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_004F43EA
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_004FC409
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004FC532
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_004FC638
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004FC70E
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	4_2_0040CD50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	4_2_004FC045
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	4_2_004FC090
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	4_2_004FC12B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_004FC1B6
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	4_2_004F43EA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	4_2_004FC409
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_004FC532
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	4_2_004FC638
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_004FC70E
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	4_2_004F496D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoEx,FormatMessageA,	4_2_004DAFC3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	4_2_004FBD99

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

0_2_0040CD50

Source: C:\Users\user\Desktop\file.exe

0_2_00446020

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F636F GetTimeZoneInformation,

0_2_004F636F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00491C30 GetVersionExA,CreateFileW,

0_2_00491C30

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\SysWOW64\WerFault.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\SysWOW64\WerFault.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 9.2.MPGPH131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.3830e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MPGPH131.exe.38e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MPGPH131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.MPGPH131.exe.3a40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.39f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.MPGPH131.exe.3990000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3890e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MPGPH131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2374176971.0000000006728000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2371863766.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1684180987.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2304201006.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2306103257.0000000006730000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2081934645.0000000006720000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2370794973.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1666330206.00000000039F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1705537281.0000000003990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7716, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\rTXApvaKL9yw6N5oqHITZ9U.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\HZqMYfpyMfdfHfQja15Vpq6.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ax62Lo_zBXq90uwBqgwbr3X.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: file.exe, 00000000.00000003.1927999419.0000000006773000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: erty.jaxx
Source: file.exe, 00000000.00000002.2081934645.0000000006720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: file.exe, 00000000.00000002.2081934645.0000000006720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe, 00000000.00000003.1927999419.0000000006773000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: file.exe, 00000000.00000002.2080428663.0000000001B5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.1927999419.0000000006773000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: MPGPH131.exe, 00000004.00000002.2374368799.0000000006761000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7716, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 9.2.MPGPH131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.3830e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MPGPH131.exe.38e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MPGPH131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.MPGPH131.exe.3a40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.39f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.MPGPH131.exe.3990000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3890e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MPGPH131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2374176971.0000000006728000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2371863766.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1684180987.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2304201006.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2306103257.0000000006730000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2081934645.0000000006720000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2370794973.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1666330206.00000000039F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1705537281.0000000003990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7716, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\rTXApvaKL9yw6N5oqHITZ9U.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\HZqMYfpyMfdfHfQja15Vpq6.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ax62Lo_zBXq90uwBqgwbr3X.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	22 Native API	1 Scheduled Task/Job	11 Process Injection	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	57 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Virtualization/Sandbox Evasion	Cached Domain Credentials	271 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	12 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	37%	ReversingLabs
C:\ProgramData\MPGPH131\MPGPH131.exe	44%	Virustotal	Browse
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	44%	Virustotal	Browse
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	37%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.233.132.167/cost/lenin.exe	100%	URL Reputation	malware
http://147.45.47.102:57893/hera/amadka.exe	18%	Virustotal		Browse
http://193.233.132.167/cost/go.exe	25%	Virustotal		Browse
http://193.233.132.167/cost/lenin.exeUser	24%	Virustotal		Browse
http://193.233.132.167/cost/go.exelater	24%	Virustotal		Browse
http://147.45.47.102:57893/hera/amadka.exe68.0	15%	Virustotal		Browse
http://193.233.132.167/cost/go.exe/	25%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		high
db-ip.com	104.26.4.15	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/81.181.57.52	false		high
https://db-ip.com/demo/home.php?s=81.181.57.52	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://db-ip.com/demo/home.php?s=81.181.57.52o	MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	D87fZN3R3jFeplaces.sqlite.9.dr	false		high
https://db-ip.com/demo/home.php?s=81.181.57.52l	MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	false		high
https://t.me/RiseProSUPPORTs	MPGPH131.exe, 00000009.00000002.2306103257.0000000006730000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe	file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse	unknown
https://db-ip.com/	file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/81.181.57.52u	MPGPH131.exe, 00000009.00000002.2305000838.0000000001C51000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe68.0	MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	false		high
https://db-ip.com/0	MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1863448564.0000000006793000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213504678.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2102868244.00000000067A3000.00000004.00000020.00020000.00000000.sdmp, 8MhogtJMRILwHistory.0.dr, sANT26gQMwt7History.4.dr, fzOGBVhWIKhlHistory.4.dr, uUNSZzd9cNCaHistory.9.dr, Sbg9DSp7lstNHistory.0.dr, Z2XBcxuCaxhxHistory.9.dr	false		high
https://t.me/RiseProSUPPORTa	MPGPH131.exe, 00000004.00000002.2374176971.0000000006728000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exe	file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse	unknown
https://ipinfo.io/widget/demo/81.181.57.52b	MPGPH131.exe, 00000009.00000002.2305000838.0000000001C7C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com:443/demo/home.php?s=81.181.57.52d	file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io:443/widget/demo/81.181.57.52	file.exe, 00000000.00000002.2080428663.0000000001B8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C7C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/81.181.57.52ey	file.exe, 00000000.00000002.2080428663.0000000001B5E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	8MhogtJMRILwHistory.0.dr, sANT26gQMwt7History.4.dr, fzOGBVhWIKhlHistory.4.dr, uUNSZzd9cNCaHistory.9.dr, Sbg9DSp7lstNHistory.0.dr, Z2XBcxuCaxhxHistory.9.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	false		high
https://t.me/risepro_botisepro_bot	MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exeIdser	MPGPH131.exe, 00000009.00000002.2305000838.0000000001CF3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.167/cost/lenin.exe	file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://193.233.132.167/cost/lenin.exe81.57.52	MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://db-ip.com:443/demo/home.php?s=81.181.57.52	MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/lenin.exeUser	MPGPH131.exe, 00000009.00000002.2305000838.0000000001CF3000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	false		high
https://ipinfo.io/M2_&	MPGPH131.exe, 00000004.00000002.2371863766.0000000001B83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	file.exe, 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1666330206.00000000039F0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.1684180987.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2370794973.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2304201006.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.1705537281.0000000003990000.00000004.00001000.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	false		high
http://147.45.47.102:57893/hera/amadka.exef	file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.8.dr	false		high
https://t.me/RiseProSUPPORT	file.exe, 00000000.00000002.2080428663.0000000001B0E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081934645.0000000006720000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2374176971.0000000006728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C07000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2306103257.0000000006730000.00000004.00000020.00020000.00000000.sdmp, rTXApvaKL9yw6N5oqHITZ9U.zip.4.dr, HZqMYfpyMfdfHfQja15Vpq6.zip.0.dr, ax62Lo_zBXq90uwBqgwbr3X.zip.9.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1863448564.0000000006793000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213504678.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2102868244.00000000067A3000.00000004.00000020.00020000.00000000.sdmp, 8MhogtJMRILwHistory.0.dr, sANT26gQMwt7History.4.dr, fzOGBVhWIKhlHistory.4.dr, uUNSZzd9cNCaHistory.9.dr, Sbg9DSp7lstNHistory.0.dr, Z2XBcxuCaxhxHistory.9.dr	false		high
http://193.233.132.167/cost/go.exeomanialisherQ	MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	false		high
https://ipinfo.io/Mozilla/5.0	file.exe, 00000000.00000002.2080428663.0000000001B8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C7C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.9.dr	false		high
https://t.me/RiseProSUPPORT0o	MPGPH131.exe, 00000004.00000002.2371863766.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	false		high
https://t.me/risepro_bot	MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2240485249.00000000067AD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2306103257.0000000006730000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.9.dr, passwords.txt.0.dr, passwords.txt.4.dr	false		high
http://193.233.132.167/cost/lenin.exe.exeData.	MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.S	file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://db-ip.com/demo/home.php?s=81.181.57.52u_	MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/	MPGPH131.exe, 00000009.00000002.2305000838.0000000001C41000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2305000838.0000000001C7C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_both	MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exelater	file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse	unknown
https://www.maxmind.com/en/locate-my-ip-address	file.exe, MPGPH131.exe	false		high
https://ipinfo.io/=R	file.exe, 00000000.00000002.2080428663.0000000001B5E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.winimage.com/zLibDll	file.exe, file.exe, 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1666330206.00000000039F0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000004.00000003.1684180987.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2370794973.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2304201006.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.1705537281.0000000003990000.00000004.00001000.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exeoin7FwmBKlOFG	file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.9.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	8MhogtJMRILwHistory.0.dr, sANT26gQMwt7History.4.dr, fzOGBVhWIKhlHistory.4.dr, uUNSZzd9cNCaHistory.9.dr, Sbg9DSp7lstNHistory.0.dr, Z2XBcxuCaxhxHistory.9.dr	false		high
http://193.233.132.167/cost/lenin.exeerty.jaxx	file.exe, 00000000.00000002.2081934645.000000000676E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/risepro_botlaterT	file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/lenin.exeania	file.exe, 00000000.00000002.2080428663.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1863969958.00000000067B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863132979.0000000006786000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865894751.00000000067B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213889732.0000000006799000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2215599958.000000000679E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.2213081705.0000000006777000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2101566111.00000000067A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2103342082.00000000067C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2100938277.0000000006784000.00000004.00000020.00020000.00000000.sdmp, w6NCEqkWwTcAWeb Data.0.dr, 8HRycHnVbK4iWeb Data.9.dr, 6GKpONOgQCQDWeb Data.4.dr, amggfY1X012lWeb Data.4.dr, s_jDytUw5zVDWeb Data.0.dr, JDpwntiCRWhZWeb Data.9.dr, rdNYuR1GWMoBWeb Data.9.dr, p5yNjy0gJTQpWeb Data.0.dr, njJisi0cnX_KWeb Data.4.dr	false		high
https://t.me/RiseProSUPPORT~	MPGPH131.exe, 00000009.00000002.2306103257.0000000006730000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exe/	MPGPH131.exe, 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse	unknown
http://www.winimage.com/zLibDllDpRTpR	file.exe, 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1666330206.00000000039F0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000003.1684180987.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000004.00000002.2370794973.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2304201006.0000000000400000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.1705537281.0000000003990000.00000004.00001000.00020000.00000000.sdmp	false		high
https://t.me/risepro_botriseproon1	MPGPH131.exe, 00000004.00000002.2371863766.0000000001B96000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
104.26.4.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429092
Start date and time:	2024-04-20 20:04:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@26/137@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 85 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): WerFault.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:04:58	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
19:05:00	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
19:05:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
19:05:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
147.45.47.93	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	UeW2b6mU6Z.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
104.26.4.15	#Ud3ec#Ud2b8#Ud3f4#Ub9ac#Uc624.exe	Get hash	malicious	Nemty, Xmrig	Browse	api.db-ip.com/v2/free/102.129.152.212/countryName

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.186.192
	s.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	s.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	Sp#U251c#U0434ti.exe	Get hash	malicious	DanaBot	Browse	34.117.186.192
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	34.117.186.192
	s.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
db-ip.com	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	104.26.5.15
	UeW2b6mU6Z.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	172.67.75.166
	7AdIyN5s2K.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	http://134.213.29.14:82/grep.x86_64	Get hash	malicious	IPRoyal Pawns	Browse	34.117.121.53
	jNeaezBuo8.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	34.117.186.192
	74fa486WVX.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	34.117.186.192
	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	https://diversityjobs.com/employer/company/1665/Worthington-Industries-Inc	Get hash	malicious	Unknown	Browse	34.66.73.214
	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.186.192
	s.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	s.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
FREE-NET-ASFREEnetEU	jNeaezBuo8.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	193.233.132.175
	74fa486WVX.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	193.233.132.234
	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	193.233.132.226
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	SecuriteInfo.com.Win32.Evo-gen.29833.28353.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	193.233.132.167
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	193.233.132.226
	UeW2b6mU6Z.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.167
	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	193.233.132.167
	Cheater Pro 1.6.0.msi	Get hash	malicious	Unknown	Browse	185.103.100.31
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.177.98
	2M1NS61GG8.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse	172.67.129.243
	RrHuyQ4GzG.exe	Get hash	malicious	LummaC	Browse	104.21.86.106
	https://track.enterprisetechsol.com/z.z?l=aHR0cHM6Ly9yZXNvdXJjZS5pdGJ1c2luZXNzdG9kYXkuY29tL3doaXRlcGFwZXJzLzQ0ODAzLU1pY3Jvc29mdC1DUEwtUTItUE1HLUFCTS1HZXItMS1sYW5kaW5nLnBocD9lPWJvbnVjY2VsbGkuZGFyaW9AZGVtZS1ncm91cC5jb20=&r=14547470367&d=12037165&p=1&t=h&h=fb97401a549b1167a78f6002a0aef94d	Get hash	malicious	Unknown	Browse	172.67.74.40
	jNeaezBuo8.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	104.21.4.208
	74fa486WVX.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	104.21.76.57
	SecuriteInfo.com.Exploit.ShellCode.69.14498.22623.rtf	Get hash	malicious	Remcos	Browse	172.67.215.45
	Receipt_7814002.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	Essay on Resolution of Korean Forced Labor Claims.vbs	Get hash	malicious	Unknown	Browse	104.26.15.182
	VN24A02765.PDF.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	pSfqOmM1DG.exe	Get hash	malicious	Remcos, DBatLoader	Browse	34.117.186.192 104.26.4.15
	file.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	hta.hta	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	2M1NS61GG8.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse	34.117.186.192 104.26.4.15
	RrHuyQ4GzG.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	FFE Order details - Cincy v41720.xlsx	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	z47Danfe-Pedido17042024.msi	Get hash	malicious	MicroClip	Browse	34.117.186.192 104.26.4.15
	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Get hash	malicious	Remcos, DBatLoader	Browse	34.117.186.192 104.26.4.15

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	952832
Entropy (8bit):	7.663785344043907
Encrypted:	false
SSDEEP:	24576:3IwoFmXsR3sf1viW1V6T/uKWZUtH6z1o:YuosfYWH6zuKd6z
MD5:	A815D2D73A30DFCAB21000B326B29C13
SHA1:	B9EC12B977B9EE6ECDCB74C7E718AD4018755625
SHA-256:	9BA89A594158DCAD47219D1FFFC94D54CEAB08AA934DFAF80A9880FEFD3E3070
SHA-512:	8F0CAD5A685E5D6093F2A7C13B1EA3B7F3F267D72D95185621DC197031711E7D6EEBA589FB08F96CCD69F5801FA7573E4818EE226E23AA7E460578D827A5FE97
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37% Antivirus: Virustotal, Detection: 44%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................W......h.Q.....i...................e-m......S....e-V....Rich...................PE..L...s.pd......................j.....w=............@..........................0k...../.......................................D\|..x.....i..\|..............................8....................q......xq..@............................................text............................... ..`.rdata...u.......v..................@..@.data.....h..........z..............@....rsrc....\|....i..\|..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_236d6df2-efc0-4d22-90e1-905525e0d691\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9083528137827849
Encrypted:	false
SSDEEP:	192:lqQNDuzQ8PP056r96E6jjlOZrYFzuiFAZ24IO8Nj6t:lqy+QK856rwjnzuiFAY4IO8e
MD5:	C2D58F92DD1B0963B10A3EB2EFA60D46
SHA1:	BF82BCBC9BBB042222735C22A07CC197EE2DC602
SHA-256:	9D9658D0E7A9CB0A3692BF7CD1C91D331C0A97CC890A9A94719DAC0AFB083001
SHA-512:	814398FE4E29AF2D15A48E1D5D9BD7DE32DB07DF4A31EA39A4B60D55A34CB02D5A7C56800FCA8D3F2325B06088E1585FFCA355D877272424738C9B79A6DB1CDA
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.0.1.1.3.3.3.2.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.3.6.d.6.d.f.2.-.e.f.c.0.-.4.d.2.2.-.9.0.e.1.-.9.0.5.5.2.5.e.0.d.6.9.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.0.6.d.4.4.f.3.-.6.e.e.8.-.4.5.9.e.-.8.6.f.5.-.c.d.6.6.5.9.9.5.c.4.e.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.7.c.-.0.0.0.1.-.0.0.1.4.-.b.c.6.6.-.b.2.4.1.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_27e5690c-112c-4d22-9e99-8c6f0b14382c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9486252450686662
Encrypted:	false
SSDEEP:	192:4yDfNDuzV8PP056r96E6jjlOZrYKzuiFAZ24IO8Nj6t:4yDl+VK856rwjYzuiFAY4IO8e
MD5:	6C30E1231E125E48C3FECBE03F948286
SHA1:	3903FE806D7021463375540069AC1734A04D7650
SHA-256:	DFBF8B8E18FBFF8B7B40FD16653E6D4FDFE9D2BF41D1ACFF6108F7F9F3AC4EE8
SHA-512:	6B7F9354A1D0FECFFF1671B450DFF4BEDB282200C572D05D5B022AA3C25E226F623B34A9AC7074E9DDF8227CA445257F64DCC09C94014B648661519AEDA52BEA
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.0.9.9.1.6.5.3.7.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.7.e.5.6.9.0.c.-.1.1.2.c.-.4.d.2.2.-.9.e.9.9.-.8.c.6.f.0.b.1.4.3.8.2.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.4.a.0.4.e.e.1.-.9.a.8.c.-.4.5.c.9.-.a.7.e.b.-.d.d.d.3.e.4.7.4.1.e.9.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.7.c.-.0.0.0.1.-.0.0.1.4.-.b.c.6.6.-.b.2.4.1.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_5bbc99b4-587d-40fe-ac59-0cbe63303745\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9016378017826701
Encrypted:	false
SSDEEP:	192:goODuznZ8PP056r96E6jj3ZZrMCzuiFAZ24IO8Nj6t:gJ+ZK856rwjnzuiFAY4IO8e
MD5:	14E0C1AF6EC2622D5F02899354B9E4B1
SHA1:	4C487464196348BEB767549E2B35FE70729B5AA1
SHA-256:	AE913AEE539E10CC5CC498E9A82D18323AC2173F6104AC44DEE7A68BB1BB8160
SHA-512:	B196BCB56072F04A7719F4CCFD50665CF8A88875332BAFA9204060BB1D92800D53E949F952CB0513629A300543CBE4148F35E186A4BA0E1203521328CC864AD3
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.0.3.4.8.7.6.0.4.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.b.b.c.9.9.b.4.-.5.8.7.d.-.4.0.f.e.-.a.c.5.9.-.0.c.b.e.6.3.3.0.3.7.4.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.e.f.a.0.c.5.a.-.9.8.3.a.-.4.f.6.4.-.b.a.0.0.-.3.f.d.5.a.0.9.7.e.d.8.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.2.4.-.0.0.0.1.-.0.0.1.4.-.d.f.a.9.-.f.f.4.2.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_5efb3555-bb77-4635-b3c4-88d10f7fc557\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9419704580788043
Encrypted:	false
SSDEEP:	192:uwODuzPZ8PP056r96E6jj3ZZrMbzuiFAZ24IO8Nj6t:uB+RK856rwjmzuiFAY4IO8e
MD5:	0C008DBC6116A14D43BD7A07A0699E47
SHA1:	29AA1F1F6016745B4B87B0634D67EDAD9689251E
SHA-256:	0C52440C687C814495331072FE68C931A37FE056CABC6738F21DE85C68891B92
SHA-512:	C5BAD63BBC25E24A877894EFCFA5BB458E73FFD826E5D9F97959B0CBFBAA2EFAEFAB569F46592A730FFB4C68224795219BB604ABA05E65585C71E8D5FEB98B0A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.1.0.1.6.5.5.9.0.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.e.f.b.3.5.5.5.-.b.b.7.7.-.4.6.3.5.-.b.3.c.4.-.8.8.d.1.0.f.7.f.c.5.5.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.4.0.2.d.0.d.d.-.b.5.5.c.-.4.9.6.d.-.b.e.a.4.-.8.7.c.3.8.c.6.0.9.e.c.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.2.4.-.0.0.0.1.-.0.0.1.4.-.d.f.a.9.-.f.f.4.2.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_65d98138-d915-4355-b808-11207aa2a205\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.941524841998161
Encrypted:	false
SSDEEP:	192:JUODuzPZ8PP056r96E6jj3ZZrMbzuiFAZ24IO8Nj6t:JF+RK856rwjmzuiFAY4IO8e
MD5:	D8D7A071E43AFE3A7E4BE969543FE55B
SHA1:	8943FBDAE76B82274190C10FA1EF52396514FA46
SHA-256:	A2781ED42CC79AE7F9754D99D915B6366838DB67786F2DE186D2E0593CCE24AF
SHA-512:	12BD614CA319A4501250A3B73E16271554B733051BD647D4776CC1CD13946564B5D477E0D2DBCCDE7D8E7A376D8575548294035EB521A2AEB75A2A934E5A7DDB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.1.0.9.9.3.8.6.3.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.5.d.9.8.1.3.8.-.d.9.1.5.-.4.3.5.5.-.b.8.0.8.-.1.1.2.0.7.a.a.2.a.2.0.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.a.a.7.1.c.e.1.-.8.8.f.e.-.4.a.a.6.-.a.b.3.8.-.1.5.0.d.4.a.4.3.d.7.2.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.2.4.-.0.0.0.1.-.0.0.1.4.-.d.f.a.9.-.f.f.4.2.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_71a1c664-e693-463e-9310-d4cb42099473\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9287725445009142
Encrypted:	false
SSDEEP:	192:Nbl2NDuzBY8PP056r96E6jjlOZrYCzuiFAZ24IO8Nj6t:Nblk+eK856rwjQzuiFAY4IO8e
MD5:	A03FBD398374CF71607D2631BA01B811
SHA1:	4DB2597B6AEF99364525F9CE486613AEFF409949
SHA-256:	4A830B61D07F6723AC3A0B7073FD0C6FFF3C5C5954944DE263EC2C88618BAC31
SHA-512:	17B8F58B723EF69BA17A15145FAB0D587EDE61E603D873B9476048F80776A859E6AC969A0755340A104CC14E4038A885D2F75FFBDFDEBDF5529232C514ABE927
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.0.8.0.9.1.0.0.8.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.1.a.1.c.6.6.4.-.e.6.9.3.-.4.6.3.e.-.9.3.1.0.-.d.4.c.b.4.2.0.9.9.4.7.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.1.9.9.0.2.a.1.-.5.6.9.e.-.4.4.f.8.-.a.6.d.8.-.4.3.f.1.5.d.1.b.f.a.7.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.7.c.-.0.0.0.1.-.0.0.1.4.-.b.c.6.6.-.b.2.4.1.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_7cf8ce8f-1aed-4201-8a63-0b00abb7edea\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9416254272087246
Encrypted:	false
SSDEEP:	192:iyODuzSZ8PP056r96E6jj3ZZrMbzuiFAZ24IO8Nj6t:iz+kK856rwjmzuiFAY4IO8e
MD5:	894CA1D6BE3D41351DA0EFDA1DB39FC3
SHA1:	844CB579706C78B3771068E59C16577B9DE87F6F
SHA-256:	D02519A5D3104A49DF5FEDBB1F9C6DAB27658DFF117C2DF3A016ACCAB312EE0F
SHA-512:	5153AFD4EDB4DE3A02C85CD931355BCAD9E003EED61F86BBC7F1A00515EC0DB8A3056A61FE52448E19997F0C16CD431E378B93E46E954626FC4E82052C8918F6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.0.8.9.7.4.3.9.0.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.c.f.8.c.e.8.f.-.1.a.e.d.-.4.2.0.1.-.8.a.6.3.-.0.b.0.0.a.b.b.7.e.d.e.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.7.9.b.a.6.9.7.-.9.9.c.1.-.4.7.f.f.-.9.b.0.6.-.d.3.e.d.9.e.2.b.2.2.0.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.2.4.-.0.0.0.1.-.0.0.1.4.-.d.f.a.9.-.f.f.4.2.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_868d590d-f3fc-44f0-b341-e996dca8898b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9483613402826472
Encrypted:	false
SSDEEP:	192:s3NDuzS8PP056r96E6jjlOZrYKzuiFAZ24IO8Nj6tR:++SK856rwjYzuiFAY4IO8eR
MD5:	FA7B657A309FA81B6308680EABFCBB20
SHA1:	EC051E90B0D3940B138141B9CACD62F688B266EB
SHA-256:	0578B3C16D4D2344482FD77F2B43769AFEADEDB16D7AC786BBFA7F672A58CCBC
SHA-512:	4C29FD284B7124B591E711BE7ECC377148537FA5C058976951F952FB39923355313080D0C29F2F8A733179CCF7DE6DF798CF623D513C249B976053D22DFB2822
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.1.0.6.9.5.3.9.8.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.6.8.d.5.9.0.d.-.f.3.f.c.-.4.4.f.0.-.b.3.4.1.-.e.9.9.6.d.c.a.8.8.9.8.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.3.d.1.c.b.6.2.-.3.9.f.0.-.4.e.f.4.-.a.6.f.0.-.d.3.3.a.8.e.5.f.6.0.e.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.7.c.-.0.0.0.1.-.0.0.1.4.-.b.c.6.6.-.b.2.4.1.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_8e82ae91-098c-43c8-af98-78b98945d2fd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9218842597270595
Encrypted:	false
SSDEEP:	192:x4ODuzrZ8PP056r96E6jj3ZZrMQzuiFAZ24IO8Nj6t:v+VK856rwjNzuiFAY4IO8e
MD5:	792CA43544142B5F59F58B2EF17BB85F
SHA1:	DFAD3B97966BA37391457E139BBB7CB271004D90
SHA-256:	55822D0A067D4B36688A38C7B3CB1FAC391DCC748DDBD3D1408DF55389F705D9
SHA-512:	FCEB3A0E1224C20EE1A762DBFE3570E9F2C256B74B3D20C7334339AE7149B6AB34E2957EB37BF7630431EC232DAA5914D5C003A6A6216BE667580B1A1061530D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.0.8.1.9.6.7.7.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.e.8.2.a.e.9.1.-.0.9.8.c.-.4.3.c.8.-.a.f.9.8.-.7.8.b.9.8.9.4.5.d.2.f.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.b.6.0.1.2.a.b.-.9.7.c.b.-.4.c.1.a.-.a.c.c.1.-.f.9.d.a.1.7.5.5.8.e.d.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.2.4.-.0.0.0.1.-.0.0.1.4.-.d.f.a.9.-.f.f.4.2.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_9107bfeb-e283-447b-b7fc-1a197446dc21\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9486315009404476
Encrypted:	false
SSDEEP:	192:ZVPNDuz18PP056r96E6jjlOZrYKzuiFAZ24IO8Nj6t:ZVV+1K856rwjYzuiFAY4IO8e
MD5:	C7B5C0A5D0232BDCFFBF2784EEB5F986
SHA1:	D6E102BC383AE770A6F06909F739D65761A8361D
SHA-256:	18972E0C2A294385BEB77039A95661ADB24B14D9AC8E0E1DC7D711199BA21C08
SHA-512:	2F41F7F65A952E007DD840327318807FCE8A82D4C40158FD5C4426E6C0790F53C2C97D86CDE83E031A539DE7B9A0CBE10464D1E68FAA4CA24D804DF9869DB24E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.0.8.9.8.4.0.4.2.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.1.0.7.b.f.e.b.-.e.2.8.3.-.4.4.7.b.-.b.7.f.c.-.1.a.1.9.7.4.4.6.d.c.2.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.6.e.1.9.d.7.a.-.e.4.5.e.-.4.5.9.b.-.a.4.9.7.-.0.0.f.5.0.a.2.6.3.b.e.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.7.c.-.0.0.0.1.-.0.0.1.4.-.b.c.6.6.-.b.2.4.1.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_26e483d4-fbd0-4cc6-b45d-6b9e29e77863\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9479126346944594
Encrypted:	false
SSDEEP:	192:EC3dxvpP7P056rPI3jlOZrYKzuiFAZ24IO8kVB:jrpj856rIj4zuiFAY4IO8a
MD5:	0CB964360E32231654471ABE9A560311
SHA1:	FBE8F786E91742C4741EBA07C18CCDE5CDA577F8
SHA-256:	068F83D3F089B14CCE759BCE1FAE6FA2027B5E85F562BE959268895D2AC253F5
SHA-512:	F3C582A329E4D05109DE6C82051941314E6741000D76CD1C5B39BBBEF214BE99C33BE29A17173EAB88733D37F5999BDC3059C7A6EB2B6986A90CC0672ACFADCC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.0.3.8.2.7.2.3.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.6.e.4.8.3.d.4.-.f.b.d.0.-.4.c.c.6.-.b.4.5.d.-.6.b.9.e.2.9.e.7.7.8.6.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.c.a.8.d.f.6.2.-.6.f.c.b.-.4.b.e.2.-.a.1.8.6.-.2.4.b.e.4.f.b.1.b.6.4.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.1.8.-.0.0.0.1.-.0.0.1.4.-.a.a.5.c.-.a.9.4.0.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_30d4bf65-0144-4d41-a1e5-2d1f034d6932\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9082570473798708
Encrypted:	false
SSDEEP:	192:AYC3dxv1P7P056rPI3jlOZrY3zuiFAZ24IO8kVB:AHr1j856rIjVzuiFAY4IO8a
MD5:	DF7F34E502EC27E2B35BF425E2C7328D
SHA1:	EA16BBC8E8884810CC38588AD01DD5A5E45EE0BF
SHA-256:	9B78DFD8319DB19F8FD6317B8EAFFD5FB7497BE84E100CE480EA074D3326B63A
SHA-512:	1F73A6DFD01FBFBC9907A17273A5F7E31C1AADA8ED6A894217AE95FFD2810FDFB1C5ECF8C329D2FFA619340B951582BD6996A93BB825165BC4CDCE7A451A8A64
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.8.9.8.8.9.8.9.9.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.0.d.4.b.f.6.5.-.0.1.4.4.-.4.d.4.1.-.a.1.e.5.-.2.d.1.f.0.3.4.d.6.9.3.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.2.9.2.7.0.6.f.-.f.4.d.a.-.4.f.c.1.-.8.8.9.9.-.7.a.1.5.b.b.1.f.b.0.6.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.1.8.-.0.0.0.1.-.0.0.1.4.-.a.a.5.c.-.a.9.4.0.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_30f7c2e0-e953-4274-809a-130ac21e06ea\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0220047215986188
Encrypted:	false
SSDEEP:	192:vZC3dxvxP7P056rPI3jlOZrYTjzuiFAZ24IO8kVB:vcrxj856rIj9zuiFAY4IO8a
MD5:	FCB643566D3A9CD52F83548945A00664
SHA1:	FDBCCA91C1A4F3289D131CBDAE9E9D31A2A6C7FF
SHA-256:	1F9599BE38C3759E0CBF948CDB5D02E4A6E95E7C37AC14EE39EC101F346D4BF7
SHA-512:	3BC72BEC502DBB59FD372AE461A57FE1FFECBE603D785CE3ECBD3B2FB315995397100B6B33F856A3352BD1E32FFF7EC628A83CF6A8B21BB773489D4CECB61335
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.0.5.8.1.3.7.7.9.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.0.f.7.c.2.e.0.-.e.9.5.3.-.4.2.7.4.-.8.0.9.a.-.1.3.0.a.c.2.1.e.0.6.e.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.7.0.b.f.f.0.3.-.6.2.8.8.-.4.0.1.9.-.a.3.6.3.-.0.f.0.f.1.3.c.d.9.3.3.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.1.8.-.0.0.0.1.-.0.0.1.4.-.a.a.5.c.-.a.9.4.0.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_350cc484-f125-4e6a-a9b7-37b821553dcf\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9954592610527487
Encrypted:	false
SSDEEP:	192:AC3dxvBP7P056rPI3jlOZrYTBzuiFAZ24IO8kVBw:PrBj856rIj/zuiFAY4IO8aw
MD5:	87524515C3EFA3CFD540256CDBD9FFB5
SHA1:	A748026F7C91CF947AC82961BFEB76982A3E7EFE
SHA-256:	A4492CA56F9346C82886DE95D81FD96A05398194621743EC88FF19116DF32F0E
SHA-512:	F9F066D341DC32798BABF133299C8B38C83533C81ADA8B78A11A900B7F5B058721F6C14315DE200E26AED5B70025D8417A4C7835EB8A99DB2666CAC571BA4EAE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.0.4.9.9.6.1.1.5.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.5.0.c.c.4.8.4.-.f.1.2.5.-.4.e.6.a.-.a.9.b.7.-.3.7.b.8.2.1.5.5.3.d.c.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.0.c.2.0.a.d.a.-.8.4.f.3.-.4.a.6.9.-.a.f.0.4.-.7.a.9.d.6.9.3.d.0.3.1.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.1.8.-.0.0.0.1.-.0.0.1.4.-.a.a.5.c.-.a.9.4.0.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_51c1b91c-177b-4c73-b33d-0ffa0a872ffd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9485875259657537
Encrypted:	false
SSDEEP:	192:XyC3dxvcP7P056rPI3jlOZrYKzuiFAZ24IO8kVB:Xprcj856rIj4zuiFAY4IO8a
MD5:	26C7C3878214885F844FA4FBF24FA250
SHA1:	83FA7745515E05BCCA6ECA685E30C471260219EF
SHA-256:	39122C5F365606B639DC55ACCD0B760C679834D112C66908D72B61BFF4039304
SHA-512:	6D731FCFF2AD9241885D33ED9B34B6DB69BEC1CD7008E4489AC56E02B2A8161776E4AED456753D1B9834B7A717329ED0618235BBC65908A3702A1A0A3F012D68
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.0.2.9.4.7.2.4.9.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.1.c.1.b.9.1.c.-.1.7.7.b.-.4.c.7.3.-.b.3.3.d.-.0.f.f.a.0.a.8.7.2.f.f.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.5.5.3.6.1.7.8.-.4.4.b.b.-.4.a.8.0.-.9.8.4.8.-.7.a.7.1.0.f.8.5.3.7.6.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.1.8.-.0.0.0.1.-.0.0.1.4.-.a.a.5.c.-.a.9.4.0.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_a77f59a8-8b59-4992-86c8-63a5f0627f3c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9221151133073655
Encrypted:	false
SSDEEP:	192:TC3dxv/P7P056rPI3jlOZrY9zuiFAZ24IO8kVB:er/j856rIjvzuiFAY4IO8a
MD5:	31231EB7BCEC64461E2962CEE7D241B3
SHA1:	F7165E911B9CDD3B2CE250866F285E5DDF860268
SHA-256:	2E2835BA9620B21306D7F0E9C7D929044E0750B91D3E37B0064049363A974625
SHA-512:	4A1E89161401A95F33392916EA546045BE4B65AFE8849CF76CF2402BF2F6EA286811D5822472E4DACA5B26FAC0A8E26D90CFD824B9DED673DC1D6C1CCB809B06
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.0.1.6.3.8.2.7.2.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.7.7.f.5.9.a.8.-.8.b.5.9.-.4.9.9.2.-.8.6.c.8.-.6.3.a.5.f.0.6.2.7.f.3.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.8.0.2.d.9.0.0.-.4.8.b.5.-.4.9.8.1.-.9.e.6.5.-.5.f.9.8.6.2.7.6.7.0.2.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.1.8.-.0.0.0.1.-.0.0.1.4.-.a.a.5.c.-.a.9.4.0.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_daed0f05-904b-4a99-8e36-6a836ebbd0ab\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9281864689477678
Encrypted:	false
SSDEEP:	192:0C3dxvsP7P056rPI3jlOZrYPzuiFAZ24IO8kVB:zrsj856rIj9zuiFAY4IO8a
MD5:	DBF01CD42B58D451DD0556073954BB47
SHA1:	96A86FAD146FA4FB7E13CB6F9D15F55CC24E1790
SHA-256:	8F2078E020256DC71D3484826CA91477EFE1138711A3B6025F6A58600F252C60
SHA-512:	D52369E0DEAAB7BB0C5697E65B50C37EB5077507706EA8657EC97CEB2EFCCE4BC76466958670635C7E77CACCD6FB216B64FBC39AD9C04C5F6AB6403314DD413D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.1.0.9.9.0.2.2.7.0.4.5.8.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.a.e.d.0.f.0.5.-.9.0.4.b.-.4.a.9.9.-.8.e.3.6.-.6.a.8.3.6.e.b.b.d.0.a.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.0.1.6.9.d.a.8.-.d.6.5.e.-.4.8.9.2.-.8.b.4.1.-.b.c.6.5.f.2.c.9.2.b.c.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.1.8.-.0.0.0.1.-.0.0.1.4.-.a.a.5.c.-.a.9.4.0.4.d.9.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.b.9.e.c.1.2.b.9.7.7.b.9.e.e.6.e.c.d.c.b.7.4.c.7.e.7.1.8.a.d.4.0.1.8.7.5.5.6.2.5.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.7.:.0.9.:.4.4.:.4.4.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER134.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:11 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	92520
Entropy (8bit):	2.251585395482886
Encrypted:	false
SSDEEP:	384:MgDKUm4WRTvQH1M3Ism186MngFdGb72dZIZfAYxLorGuB2M8qqK9vAogd5MBCGb:NDHmxRTvQVjS6MneI2ddYxLo9oM+
MD5:	CCF19523F4BA9B5B38676CFB1B070251
SHA1:	61167AFEA3305C3973D17383A1B6D277CD3E0BF8
SHA-256:	F79BC075003F8EE63839EEB6F69C4C10123BBBE8D2FDD69E6D024D30ADCB5B2F
SHA-512:	BA13907A0503F340B937EF06E2337CD78F1268D679B799F5AF99D77A54D758BC00CAE183FD7236A2A8F44D34BC3ABEF212805662207B62F76608848B437E8E0F
Malicious:	false
Preview:	MDMP..a..... .........$f........................D...........<...........4....>..........`.......8...........T............)...?......................................................................................................eJ..............GenuineIntel............T.......$.....$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6404
Entropy (8bit):	3.7211099350163033
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbmuE6rO5YvYnlFXiWqgaMOUO89bkxsfYMm:R6l7wVeJmuE6kYve9pBO89bkxsfYMm
MD5:	4B188D94A259A5730B9D7C4F32DE17F5
SHA1:	760EE5CE2E58847AE4F706945D1730658AF3F5D2
SHA-256:	03ECCDB74D74EF4F5A5570B9E2D54A4B7EFC79BDFCDBD77806728ED5E299B64D
SHA-512:	CEEC5BBFCD48E78AF852FB78AA42626CA27F56D8BEE01B91C5E7FAEDDA99EB02A59F98F15F47F01521B687B7B4B49BF512DB02FB067A01D5B736B52B2F81DFC6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4DF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.477671891429099
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VYDYm8M4JLJFE+q8vhZTVgCTwd:uIjfYI7mm7VDJkKTTVgCTwd
MD5:	D03F852D0EE1E66998A7B731403A8A33
SHA1:	1997C7D23F4DA5C69BEB8A5A120356B9DBA94CAC
SHA-256:	1169C767E8B821DD088BC403BE0296D69985988E6657534DEBDB4E0480369ABD
SHA-512:	08FCA404A54506FFB97DF08AFE2A034E3419D3838538A0B405E1CCF637DE6C35895D12E2A4DFAADA8FD5034613C0177E46D844F1D4470615302BBD0AF5CB3782
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC7.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6406
Entropy (8bit):	3.7206543248353454
Encrypted:	false
SSDEEP:	192:R6l7wVeJvuY6S2XYve9pBT89btFsfrZPm:R6lXJR6S2XYWWtefY
MD5:	F76FF88912DB3CE881162FB476A901E4
SHA1:	D5E4D354F6D2A1AEBEBAFEE6B5EAE0CA8533D522
SHA-256:	076842438FAD2830686AC65259DFB22479C769CF6ACB54BB41F4C2907D5BC793
SHA-512:	0B557EC8C03D3F127BD506CBDFE1FB46FCDA66BD3B2DBE4FB5EA43D2ABFEB7130213A16551C06A69C938250296785CFB19BBF1E110FBF90F2846FEF02851119E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1D7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:04:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57816
Entropy (8bit):	2.235845580063549
Encrypted:	false
SSDEEP:	384:Rjl/1PhjK1TvD2jMMOsIqYczfWAYxOoIAHNxzoGY:v9Pk1TvKMjXozpYxOoIM+
MD5:	74103E10C3223772361FFB2564E828A3
SHA1:	7CB97AEC93F1E27E07A42C5782F6788CA290E9BE
SHA-256:	74D4D21D55C96BEF294E04B4CB7684397883534CC5A587283CBB01D81AB55363
SHA-512:	925395CBBEAC2E847FFCD79458D4DA435441D609CB60A36C478E17A5E6B280E4C3BD95A91A2BC7571BC39C91096EAE5B74B86A077972BB1A11DE3D15B2F69EC5
Malicious:	false
Preview:	MDMP..a..... .........$f....................................$...l.......d....0..........`.......8...........T............!.........................\|...............................................................................eJ..............GenuineIntel............T.............$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2C2.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8408
Entropy (8bit):	3.69321730819331
Encrypted:	false
SSDEEP:	192:R6l7wVeJtCh6O6Y9GSUe6gmf6S9pBt89bJ4sf3Dm:R6lXJm6O6YMSUe6gmfPYJrfq
MD5:	FEF37187A4B4B7B3337D966CDD2219C3
SHA1:	0659F0F54F98C330991737EA9795ECB878F1AD8B
SHA-256:	F54C45C07750B73289DC19EBF615E4A2A5220D30F52B509C7898ADAA110EE1BF
SHA-512:	87A4F56608CD3C5D9926C9C8C4B35C821BAF073F0E017236BF9C21BD9323CF68C46847421889335FE45BC9B3531DC7BAA4A6B160805B42C6E0E8E3F14F85B152
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2F2.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.4537000000182925
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VYJYm8M4JPJF3LP+q8vK7j8LCo3d:uIjfYI7mm7V5JnPKcALCo3d
MD5:	6922EE4D4702309FBDF8EEA9A0E84AA7
SHA1:	A650BA6F6DB0CBE30179DE0022DDE5E59EA6202D
SHA-256:	4BEA38456094AB76538350577C45A449C15CFB79F123C03C2C8F60B38005FFEB
SHA-512:	FB1ECA38B12E75C391FC6B6EBDDA10462AB74D3273DE53056E81B108E20023EF2EB063D825F08332A7CB336A6FB6F456C77ED1E7D3185D2A0A24810FA7B2D421
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA91.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56560
Entropy (8bit):	2.220330742748371
Encrypted:	false
SSDEEP:	384:C+Wo/jb1TvSz2aOsCjCv9pVYxK8cMCWt+4MT/:m+jb1Tvc2aOeFYxK8csQ4O
MD5:	0B9B118359E8542D4C25C65E4B3AC62E
SHA1:	6F9F156F767F7402B160C11ABA4D7711A45EAEB9
SHA-256:	0351BE1EF81E04E72E74AD3C2A22B2488C90B6A9A10181DFC88EE2BE09AAE09A
SHA-512:	603715803B037E78EACC1A2C73A352176E58AB034E031DFE5AFE007D68AA3017C804BEB1A6EE82CC48B6454516C5649086718B4421957ACD09798B3B053CB579
Malicious:	false
Preview:	MDMP..a..... .........$f........................(...........$................/..........`.......8...........T...............(...........$...........................................................................................eJ..............GenuineIntel............T.......\|.....$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB1F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6400
Entropy (8bit):	3.719110798552588
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbvuA6q6YvYnlFXiWqgaMOUv89bFFsf3oXm:R6l7wVeJvuA6q6Yve9pBv89bFFsf3oXm
MD5:	F71BFA080784D17FB8D9AC016EA5EC41
SHA1:	34B0DC0A9E0B48019E9A38F16F70AE9B5E72404A
SHA-256:	EB9F6D50E87E0B6D02C960ACBB0803FF445C658713771B832AF78F8462071542
SHA-512:	C317FEAE90A5B0EDDE1C0C64BC462070BF1F96B5F2EB94456237E8C476D08AEF6F16D1038BE5EA4B4E36594F534554BEF8A7819C50729BD5F141AF6CF7F74289
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB3F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.481068435075929
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VY0n5Ym8M4JLJFZ+q8vhUtTVgCTrd:uIjfYI7mm7VdnoJ5KOtTVgCTrd
MD5:	64BB7BA1F58619285123E791BE9A2ABC
SHA1:	D6C13ADDC262205AF8FBF2F7A93E24EB92A3257F
SHA-256:	8E2483DEC1CACF5F57788919CB4C0A112A448B91E022CADB53A79CABCB34D663
SHA-512:	E238947753633713A832978C306C9ADEAC25E21107F05C5F45790C03EE5B1D8164763EC01E14E6D5E9396B1A66CB94A617211FEE30349C34F9E5962B54F774D3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC95.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	69400
Entropy (8bit):	2.274028638536743
Encrypted:	false
SSDEEP:	384:T0cgKv0qn1TvzWVnskZX/n9i6S3NZdWAYxOoInMdGRUH7yq:wc3v0qn1TvzKnb/nlYNZLYxOoI5oy
MD5:	A31A6894E64EDA255CD47D389D62C730
SHA1:	B34BEAC0F5C93EADD8596195A0527C6C7FC415E8
SHA-256:	E3D38386AB414D1EEAB4723E673C7626D5BB03AC0A33308475E3AB0357E687AD
SHA-512:	07A01CE641F59DEB20B0557DFD9A5874EC314CFD13B6010D86105628D4729016BE4F58CA4FC2F18851513308D5783A608AD33EC5409B985107915A30C2247C96
Malicious:	false
Preview:	MDMP..a..... .........$f........................l...........<...t............4..........`.......8...........T............%..`.......................................................................................................eJ......4.......GenuineIntel............T.............$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD03.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8408
Entropy (8bit):	3.6939755149969327
Encrypted:	false
SSDEEP:	192:R6l7wVeJtCx6jI7Ye6Y9sSUF/gmf6S9pBp89bF4sf0lXm:R6lXJW6jIt6YWSUF/gmfPUFrfx
MD5:	67714CB64DD6475B93D07DE8930E1496
SHA1:	B624E03FE21FB84400CA4703D746C360128E4765
SHA-256:	24C3A29652D2FD7C375A56B7F742C0D39B5541E35CE949EE40A22FCBE6519169
SHA-512:	ED6F7442B1A380B68C1F7F0126C4CC8A0F21A7D24DADFAB5E8FF698904A266B1D3CEB3660A4BAAA24A1C28834DED3BADED5945A66234D4EAE2C41C7E2158A679
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD23.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.45305112643054
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VY0JyYm8M4JPJFG+q8vK7j8LCo3d:uIjfYI7mm7VdJ7JqKcALCo3d
MD5:	F640BBF3632BA0E8701EED34DED4C739
SHA1:	0FD03832E1308F7CF10BA6A2B0D0E503D18D18C8
SHA-256:	88B8CC1D18ED9E2757F206316FA57577E833226DCCB6550F0FBAB0319512812C
SHA-512:	3E28A39C59AD666ADBD4B87E2C49ABD9933B1134E50DDC84DB93CE5BD75317F7D8E45C5B9A324F4901B34CD322945EC18AA5F544DA91C66C8BBE5BF7F4EDCBA2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF06.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	75652
Entropy (8bit):	2.223155097410558
Encrypted:	false
SSDEEP:	384:WvF1Lf31Tvlg5a1FknYwOgsAzCMjS3NZdWAYxOoIoM6IWCJLizHU:m9f31TvlgwnknygSgYNZLYxOoIFW
MD5:	CA1591A80C5817B725E1B61E0AA2EA14
SHA1:	3AF01D6EA3CB7ADED082CB3DFC1335EDA478F51D
SHA-256:	CEC0DE28F37936C94A86CDC1FC216C63DD8417C3FDED3BC5E379C1BF9077D5B2
SHA-512:	EA7CD341035DED0D5390EA3C98539C6EA1CF7D8DC70924B8F528C0CCB18256B30C159B6F10193565207739A64D69CD9393658E6BB2EFEBE975C1B9B756C9C595
Malicious:	false
Preview:	MDMP..a..... .........$f............$...............8.......<...........T....8..........`.......8...........T............&..............L...........8...............................................................................eJ..............GenuineIntel............T.............$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF74.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8408
Entropy (8bit):	3.6938110600620946
Encrypted:	false
SSDEEP:	192:R6l7wVeJtCE6c6Y9KSUF/gmf6S9pBB89bu4sfs6m:R6lXJD6c6YwSUF/gmfPcurfQ
MD5:	7A02D030333451DBCFDBFFBDCE4B60B6
SHA1:	316FF2020C08F9EB51ED4B5BAD1DD8A47B03CF67
SHA-256:	25B9A7F813F1FCE196770526F54697970B58B5F85B7EEA59CC4554B9C30C088D
SHA-512:	5AB037DED380EBD3C6D8FAB46D82298135FB235341464D955C1DCD3EBF56A6BB17258EC3172121AB83562CFFEE1C530122FC236BA00AA7B6C55C4A5178871ED5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDFA4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.452576771773431
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VYmzYm8M4JPJFiKJ+q8vK7j8LCo3d:uIjfYI7mm7VSJeKJKcALCo3d
MD5:	922DFFC9AF5F8B65B04F4BFCEF9D669F
SHA1:	EF715D2D1434A0545174EF035F5F23CD4A8FD821
SHA-256:	D21003565AA33616C07F076DB8290F7329F18A93DB6565C641F40623D28BC8B6
SHA-512:	A7C6881D75BDAD62ABD838EFBC72011841B0A3ADA0BEC90F6743021653697A699C3572F2C434338010B5B2790EDC6788C460583B07268F3CA688F20307F94FC6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1A6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	80466
Entropy (8bit):	2.1383908112059933
Encrypted:	false
SSDEEP:	384:irRtrEei1Tv+H8Imv0wnYJisF+uL6S3N5dWAYxOoIKM2ZV75p96P:S4ei1Tv+E8wnQiBYN5LYxOoIAhY
MD5:	A395E387DEA5F293C728F3DA65FC0E80
SHA1:	A434D27AA11030877F4A798B5BF122F6C52D8061
SHA-256:	046E89DE60CBFD359A43F29E9615D4DFCBD338CB716C018C57BACB4E5693E9B6
SHA-512:	CEC586087FB70D9FA5943CF3293C59E49A846150A628BAD97F15558484A51B32803FA15D0BB31C69B9010C71C47BFAC23735DE00631306159AC7EB0FB6C0E09F
Malicious:	false
Preview:	MDMP..a..... .........$f............T...............h.......<................<..........`.......8...........T............&..Z.......................................................................................................eJ......D ......GenuineIntel............T.............$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE281.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.6963899327037
Encrypted:	false
SSDEEP:	192:R6l7wVeJtCA6rT6Y9nSUBFDgmf6S9pBG89b34sf959m:R6lXJH6rT6YdSUBFDgmfPd3rf9K
MD5:	DE2DF7C48FDD0B8695B7027D60F05768
SHA1:	34F75AE5003E970D1583D0CD0D7E7BA88E183541
SHA-256:	24513F2BBE0EAEE26464394B1E20F1E019018F264DAD4A3CAA83B231335AECED
SHA-512:	8ED8FD64E2C86C7B082CF869227085374C70C4A0BF07D919BAA1C7AE2412142B8371C33766F2ACEE3AD13C446639CC10F5AE14ADF4207BD6F2FB1DF2C635C8CD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2B1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.454607891336303
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VY9Ym8M4JPJFG+q8vK7j8LCo3d:uIjfYI7mm7VpJqKcALCo3d
MD5:	002BE1B74A87866BDB3AC8952B4A663F
SHA1:	D0CA438D9EA716F5057E43F9082A97037A4B4209
SHA-256:	0DE1E7C737CA727128FB6CF007844023071FFBB56569EEC440046E4E62A82A66
SHA-512:	8D50C2BCEC7D4E552BAA4983D531569D587A90CA0353971C32AA15D410A5A159A362BBA03F05147A4B9E8718AEF8F45FCD393B40AAC10E63679F67A844DEB86B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE3B9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56184
Entropy (8bit):	2.2273095130691476
Encrypted:	false
SSDEEP:	384:JrqLLGPtRTvH5xj9OUsODZVNcgfAYxvo/APbTGk:pALKRTvHt5IYxvo8bTj
MD5:	A994E9659D16BCAF1782EDE3968DF713
SHA1:	7DE62F92AF927D2D495B6A7D6E19E88A763A10BA
SHA-256:	73DBFE855CDD5DF55EDA585F9597F737D4BAD945F12620A7E5F72CDCB0E1176E
SHA-512:	7E9B11C7D4641953156757F7C763F04527C41C96909B926BF723EB339A8FD8AEB721526071E6E2832076E83D77B3EC7F43A3E86934A3BEC26653505E7C438CD7
Malicious:	false
Preview:	MDMP..a..... .........$f....................................$...............&/..........`.......8...........T......................................................................................................................eJ......<.......GenuineIntel............T.......$.....$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4B4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6402
Entropy (8bit):	3.7222339894698346
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbmu06LLVYvYnlFXiWqgaMOUO89b3xsfNqi9m:R6l7wVeJmu06FYve9pBO89b3xsfNx9m
MD5:	354F58839998AEEBCD8B0EB440A4D720
SHA1:	BBCE607008647EEE735970A078E2880DD4863319
SHA-256:	1BCC5950516F18627DE710FA1023A7C47CC99BE763FF80F6C979476FC2A51452
SHA-512:	768C8D456909E13224C88ABCD80EE695184AF6E4379B26530078934C2746DD8B39D6574675419C93053A8C390E26369B5BAEACE6AB049CFD4C4082BFC59A93FE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4F3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.478712793580578
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VYfZYm8M4JLJFH+q8vhZTVgCTwd:uIjfYI7mm7VlJnKTTVgCTwd
MD5:	2B70D08F4FD1D886D6949F43DF5CE19B
SHA1:	0BE0024F64F90540CA6C589984D374C0269096BD
SHA-256:	7C5603ECCF5927B29EC40DBB1A2388B6E48853B7370BB6A897CBFCED2DC823F3
SHA-512:	C59A9892AB1B2E9C960EE5392F9720B019A35B308F0319E285734CA06E9703FD40315BAE5C0F62D701EDE3E639BDDDD75AFC6138EDA47541867C356DE69D647D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE511.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	94112
Entropy (8bit):	2.253313280419728
Encrypted:	false
SSDEEP:	768:FJwNbUR1Tvvo5+uhn1De57Y3uoIhAkPUsvN0:LabCIDh1DejP5C
MD5:	108FA1DF8467BA8EADEBE08156362D8E
SHA1:	680E3A39C35C71FCD653F972104E9CA77C9FB3D5
SHA-256:	04171F40DF0BCFE24F05ED640909C1B912E5D863374BEA8725A0708C5446F0FB
SHA-512:	7E631F455A5492F87F3A8623416459C9C088B59F15CF455B0ACD8DD9BB43D8086B16C02050E1B9DF063E4B087738256A7F0C16C422E902CC7B58E45CC3B17188
Malicious:	false
Preview:	MDMP..a..... .........$f....................................<................?..........`.......8...........T............,...B......................................................................................................eJ......t ......GenuineIntel............T.............$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5DD.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.6942431181890263
Encrypted:	false
SSDEEP:	192:R6l7wVeJtCw6pB6Y9XSUzegmf6S9pBH89bY4sf7Im:R6lXJ36pB6YtSUzegmfPKYrfh
MD5:	CA9755F14936D767CB54EFF64E23C68C
SHA1:	D948FF59849092EC61C34EB61E97A67D4F2DAD1D
SHA-256:	501F6093A488128CBA322A7EAE8BFFCCF4B01B4AAE2F3B5B13A0122420E0B165
SHA-512:	7F5B7E515C721A909676EA2F978B3A08B53E9B3A617C5FC697341294B458DD512E718B871C46ED1D3A80D257547215FA62B3C296C2FC3F3C395D44CC83A96751
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5FD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.4531032237199195
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VYFJYm8M4JPJFU+q8vK7j8LCo3d:uIjfYI7mm7VHJgKcALCo3d
MD5:	87B70A542A4DE44621382E54CA150C44
SHA1:	D603AD5CE0AE6AD0D28BD815E91E62312D1DE52E
SHA-256:	93E8EE699C88A2EAA3329141E08217563E3342FBDD1373B0DA41BA5C784AB177
SHA-512:	B66737A9D2EC44F3E3C562E9A6F3D169C96598BC349DB4451BF043302D7966DF67F9AC1770CC7D91EF1AC3FBA011BF03EA020FD1866D52E818453CF88B0E1267
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9A4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	104908
Entropy (8bit):	2.235039619678787
Encrypted:	false
SSDEEP:	384:Zo9W0VsQ1TvIBtIBq9o9/BysMXwOGZb3Agd1n53mQBWkY3+oIxMqbiYh95TJgXtK:m/CQ1TviEq9O0RwRDdnmQ7Y3+oIZNqY
MD5:	1C8CFDADA1D28C9AF0E0512082E331AD
SHA1:	740A0954F05335D3F5B1DDD96B42AFC857E103A1
SHA-256:	D48F57FC820102D9A7DA8A4565EB92B34571783FDB82264474413CE34E6BA28B
SHA-512:	204C6DC0A874AE3005D59F36370DE41AFB5D32284D9A84ED0B2D849164C59F053E267133CFD6C449C4A5E24547C41ADAD944E643CF79C4C2959FCE6C487C2F68
Malicious:	false
Preview:	MDMP..a..... .........$f....................................<.... ......4...ZF..........`.......8...........T...........`7..lb...........!...........#..............................................................................eJ.......#......GenuineIntel............T.............$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA42.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.6945513886072043
Encrypted:	false
SSDEEP:	192:R6l7wVeJtCA6r/6Y9zSU3Qgmf6S9pBH89bh4sfxLm:R6lXJ36r/6YZSU3QgmfPKhrfg
MD5:	DDFA0A3AFE3F50E42FC2D6B5C5349383
SHA1:	7E0A936F4B40218E603AD277B2DFED578615C22E
SHA-256:	4EF099A87D29E15108DF06F57B1659014F8C17A8BDBA0EB4AF6F39D632E4127C
SHA-512:	C2174B1C1176F1BAB244563BAD0820ABABEC5B347196269458B62F5B30930EE25C0C8F5A536985BE4BFF4F6248096D9B19239F6CE669AEAD4B92573903E154C2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA62.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.45089327125271
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VYOYm8M4JPJFe+q8vK7j8LCo3d:uIjfYI7mm7VyJqKcALCo3d
MD5:	601EE8D7C693C7886CA562D77D131ABA
SHA1:	981446A12B767E4610686DE162A47CC933EB5A3F
SHA-256:	32A5808DD9BC5F0CF2E5164E1196192933564583D1CDEA10D93D7204F64915BF
SHA-512:	8082A06136B7C34A0C463E30ED752F1B7BBAA47BF9E28E6F081A81F5F1E18137AB10DD738EA31B8439DA4EA18F80BC12A79F10AFA0158D580566DFCF8B33BAFF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERECD1.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	112674
Entropy (8bit):	2.1460246049314256
Encrypted:	false
SSDEEP:	768:eEB941Tv+pU4t9lpIsQRY3+oIz8rVZPKj4Vj:e0M2iw/pIsCCV5Kj4Vj
MD5:	7B81CF9D517F6CFA09094469CDAFC4B1
SHA1:	CE08ACA27D7B8641A7EAA4DA5C0EFCF55493EAC4
SHA-256:	358AFC0E190DC033CB0C06F316CACFC3C0207D67C650320F574CFA1C2AD9235C
SHA-512:	0A9759B7A20A522C01E7D368093886CA966B284967701E44609C7683F7422E84E310BF025C99CF016EDBF6772A8E56F0B6C74792F1EB1546D9789C664A181181
Malicious:	false
Preview:	MDMP..a..... .........$f....................................<...."......T...tK..........`.......8...........T...........PG...p..........."...........$..............................................................................eJ......x%......GenuineIntel............T.............$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERED6E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.6924401158679707
Encrypted:	false
SSDEEP:	192:R6l7wVeJtC16s9c6Y9qSU3Qgmf6S9pBa89bh4sf4RLm:R6lXJC6sW6YwSU3QgmfPRhrf4A
MD5:	88DF513299994F252ACA869888B067F3
SHA1:	87703A390DCA5EE0FA898C598281DFBDB199EDE9
SHA-256:	B382B8E45CA1354AD4AEC4A1BC522AEAA255BD61638F006E603572DCAF4358FA
SHA-512:	CAC18564C2FA862135C9E92BBC989899E25D43213C436E55A32399C656C2015F7BBA4B6640F380A7EFEAD3649C30F2CC0365ADEA204CFC4202384DFB47E5493B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDAE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.453390574107926
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VYIYm8M4JPJFd+q8vK7j8LCo3d:uIjfYI7mm7VAJ5KcALCo3d
MD5:	BD4DC9742D3D010527CC702A1383E8CC
SHA1:	0B36243521D86997B840E41EE40E3341DDB98511
SHA-256:	29D794F8ECE30BD19D7196CDE3FE4B6BFFAA250B591C0AE59173E09D1C396E0D
SHA-512:	DEC5DD75433F40CDDAC04F9F56900D3B8D607B1B8514562FA59F9264475FFD40FFA84D3FFED99AD40F8425A561963B624F6E4F68FC577CFE469AD9F1D5936584
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5BA.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	68800
Entropy (8bit):	2.285558441463831
Encrypted:	false
SSDEEP:	384:JJSyzBQV1Tv/Xnns7yzbHeeouKrXpVYxK8cz7U9pUoK:bSQyV1Tv/XnnpzyeVKrvYxK8cqUp
MD5:	9D98EFB15AA1E90A7200F8BF277182EE
SHA1:	585E8900AAE4A31B6CB23A982482EC5A1FB35B0B
SHA-256:	9CADA4B635E17480F58874780E507D1B3097E13E74AEAEEA94C6A7BD04371E8C
SHA-512:	FBB09C872F8381BDD1EABDA3267EB60E2CD00FA921348A9A8332043FE16D68996BB3F1347F946BE28071F5ED1FA07DF5721DA805DDBF31CC985CF244AE9061BB
Malicious:	false
Preview:	MDMP..a..... .........$f........................l...........<...t.......$....4..........`.......8...........T...........($..........................................................................................................eJ......4.......GenuineIntel............T.......\|.....$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF637.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	68444
Entropy (8bit):	2.2912660114626417
Encrypted:	false
SSDEEP:	384:CoZjQZCRTvgs6uCuGsAjsLv8ldihVzGAJZI+fAYxvoGdHA04:NBQMRTvYFTjcCMzGAJKYxvoMo
MD5:	170EBA843DC1DCAA5166D167097487B4
SHA1:	A096C8E618C2858DF3F8960EA5DFAAC128BABCE2
SHA-256:	1B2D5AF7D7C245BE581986748556A66062B9BA2C826E40FA462E2277955AB657
SHA-512:	1DBC63C9D5B8BCE9F02352C16CCC615A00C0CDF8EAC53D701254086C42FCDACAEF7A805DD7C4B4AED02CE112B07C4CB44A35AA31BE2893B7F3C3BF8DBCD507BD
Malicious:	false
Preview:	MDMP..a..... .........$f....................................<...........T....4..........`.......8...........T............#..L...........D...........0...............................................................................eJ..............GenuineIntel............T.......$.....$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF6A6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6402
Entropy (8bit):	3.721396299674726
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbvueY6sYvYnlFXiWqgaMOUG89bEFsfhgTOxsm:R6l7wVeJvuB6sYve9pBG89bEFsfhbxsm
MD5:	487D4105E7F51F6272622DBA18552862
SHA1:	80E2F4EFBDF37A0DC652082C9E2CF84863E9ECDA
SHA-256:	58CEF4B06E0A1EB28FE40A2749794DFAA1D1197ABF599B9A0514E2037003FF3E
SHA-512:	8BC1E13AB01BDC30E40722CDE2D29251A5801CECAE88B94D18E2BE064E1A207290793F2EFD47763D50631FDFCB5EB0E381453F895B90EC8E5C98321948031B84
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF6D4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6402
Entropy (8bit):	3.722254634620534
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbmuub6A0YvYnlFXiWqgaMOUM89bExsfLysm:R6l7wVeJmuK6zYve9pBM89bExsfLysm
MD5:	6AFF19C20327366135FA525CE39ECAE5
SHA1:	BB1A5A1A0A44162711C150373BCB4862B0C4008A
SHA-256:	057C0FDCE396D6E6A288C6D755ABA73F785564B20D2F037DE995D5ED4BCEDCBB
SHA-512:	0EF0BBDEB49D5E23B1E98292558209259F5ADFAA08922D6E26C78F526E728996C7270EDC5D673049A64326F14F8CACF35D3CBD5FB1A5A142ADC9D01503E76584
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.478932770860301
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VYuYm8M4JLJFo+q8vhUtTVgCTrd:uIjfYI7mm7V6JIKOtTVgCTrd
MD5:	4B882532753BF13BAB28F6B03D91E388
SHA1:	581E026ABC756C8C25393FB3C91A66FCEF7BDBC6
SHA-256:	DDAC400C8116EC9247DFCD10EB4F365877F16D66886BAF53A88AA9B22F21D71D
SHA-512:	E396AB6EE3DBCDB3FF7C40E05227A08769171C3426231B32C52C23F9F26C6DF8B7516AFF560691BFD8EB5DA61F2D044CCE7A9B57891ED6A36CDF59A3301D6346
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF704.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.480414570151488
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VYFYm8M4JLJFCk+q8vhUtTVgCTrd:uIjfYI7mm7VxJikKOtTVgCTrd
MD5:	F33D4A8660B66CA3794712DF7DB83344
SHA1:	93383180E345A6B965F99F7B284FF3FFB1873E52
SHA-256:	70E9BE876BFB9DE9D607E188471A6498F143157866669F276E1C98AD6DC7941C
SHA-512:	D214DF872E806F23CAE2FA09747D3F416F1C8FCA289C516DE86AB410293D6CC52F3DFE1AB6AD01DE9C3E79EE3D26DC25A8FB6EC30527C4A2245B5F63F5148985
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF714.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.4784135750111735
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VYC2Ym8M4JLJF8+q8vhZTVgCTwd:uIjfYI7mm7VT/JcKTTVgCTwd
MD5:	C80B5F2E2A2CD6503B4A7326C4BEC95C
SHA1:	9CE1725BB2FB70475FF90E730F4F1F999F7F64D8
SHA-256:	520296612FE6E6BB8716FD35D8F3B373AAC6107A777A8734285F3F2AEBFC3F55
SHA-512:	5EAF01E6BB88377F0BF06F1583054A06B433635599819C61249ADCE77BD475A25ED6614202346A274DDC4F5F65F21343E88EDDC37F45AB813975A58EB3EAB7A0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF935.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	79634
Entropy (8bit):	2.1232749371721233
Encrypted:	false
SSDEEP:	384:b4yXTPlW1Tv2hspylb3AtG8sAdz7NKrXpVYxy8ch/0rXtZgh:b9jPlW1TvKspu0o8HKrvYxy8cGbtZi
MD5:	FAB3FDE2559DC5CCBE58951FEDAD16A2
SHA1:	84CBB23FF86AC35FF024C8FF315067A1B4536DF0
SHA-256:	79625F733678BBDBF8A3C221C5D65CD75F2E0236E91F4A65B6EDC66CF8608968
SHA-512:	4271A480BAF86C02BB50902A76D4A99988E76B1199B1BA04C12B6A092E18C6C095129E5406C4C6F57075E5FCA54AFA0DBCDA4F634FB2E7F7E182FE9D34E582CF
Malicious:	false
Preview:	MDMP..a..... .........$f............T...............h.......<................<..........`.......8...........T............$..J...........T...........@...............................................................................eJ..............GenuineIntel............T.......\|.....$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF964.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	79258
Entropy (8bit):	2.130088694417233
Encrypted:	false
SSDEEP:	384:BXSD6XJqFwRTvG20ShHglgZdibs1pFzLzGgJZAZfAYx3oy0+MSRU/7:B8UJqFwRTvG20ZlmASTzGgJVYx3o447
MD5:	BED543A28AF27CC7F35048AB6CAE22EB
SHA1:	4CC5750027CFA52FBD63D57DC34DCA1BAA4C6FB8
SHA-256:	D39AA084C7E050F022115E5DF0CB04441890213062677C05BE97E994B748281C
SHA-512:	1A9C4478B30FAD429E7C310F6F38DB92EFAD3A46FF54B016E31099F67E8A60A482EA8F31BD17F564C9C91BB6EC60EFE875408C7000B554187000CC6B3644D9C7
Malicious:	false
Preview:	MDMP..a..... .........$f............T...........D...h.......<................;..........`.......8...........T............#..........................................................................................................eJ......l.......GenuineIntel............T.......$.....$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFABC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6404
Entropy (8bit):	3.7208723859650434
Encrypted:	false
SSDEEP:	192:R6l7wVeJvujX6BceYve9pB+89bNFsfdxvm:R6lXJYX6jYWFNefdk
MD5:	E140C48FB99F1C892CAA87F727795383
SHA1:	AE22F6EB4AFFA3BE2251E1EBB503FC37E06AEF3B
SHA-256:	E4D9574F3102E057A2915A654F6EED641AD463D920A890618E0D1038E6CEC10E
SHA-512:	85646C725C123668A1A15B521385D62921BC290E08A486E8E89657F83E646FE8A07F45A75514E435E90DBDB3535941BA6D6A1CC9F45C44CCE28C8F0D96EF9C21
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFADD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.4782432635254334
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VYWYm8M4JLJFl/i+q8vhUtTVgCTrd:uIjfYI7mm7VGJF/iKOtTVgCTrd
MD5:	B0887E3885BCE317563BCBE1618E12FD
SHA1:	5BFA4483F6FEBB84EEC03B950819D0C39847A0CA
SHA-256:	0C961C0E73E57EDA50C6962A350A2AC9880FD4C4A4649598D7C079F0CB6048F6
SHA-512:	84FD5C02782E3AB656AC0C864649BFA0C76FE3CB8E6244B71C5FD83822B17B2FC772A7266EC5BF28C7AA3CCA423E82B31B1EDEC893F2C3B6EAFE8BFD77F2DB4A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB1A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6402
Entropy (8bit):	3.720234916746293
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbmun6QnYvYnlFXiWqgaMOUM89bNxsfM7vm:R6l7wVeJmun6CYve9pBM89bNxsfwvm
MD5:	39C63C79A0A0938530B2CD4CC40B5F74
SHA1:	419786BDD096B4273406A5E4FEDC758D96CFBA0A
SHA-256:	5A502519AE43498AD956C56513D13BF5D9128458F806F0E398104F5E70AD210B
SHA-512:	3504DB98D2D79310BECEE460EDE88856B9C9F4499F03DCE9862BC3DB007A8EBA00B7CF65E5C0EE3F1FF9B3A0AC1569CCA514221007F404C47258BF650E5A82D0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB5A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.480682268249986
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VYAYm8M4JLJFAnHlo+q8vhZTVgCTwd:uIjfYI7mm7VUJK+KTTVgCTwd
MD5:	0F8C1FE553B7D105EBB072D04DC29F04
SHA1:	5B34507F97966A306F675B4C7C8D9CD5BB301C50
SHA-256:	3BE61C63671B76E59039B8244F4AF271C27BDD3D9870517BDBD83EEE11FAA8D2
SHA-512:	C525841B9A68A72A44D3E7FBE058BF297D8DD898C1A367D6D32027D4DCB12B41A325369289ECB8F5BC06FA5307AD956068B650265A6D6D75B2A35A22126402F6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFCDE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:10 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	79210
Entropy (8bit):	2.122784027703538
Encrypted:	false
SSDEEP:	384:RryXTyL1TvNtrbRbaes0k0877NKrXpVYxK8c6k8ieIY47A:AjyL1TvrrdOeFYKrvYxK8c2ieW7A
MD5:	79AA036EACEFF5BB727C78865CD515FB
SHA1:	3E0E267BEF7C092A46A55A0336A9C2A8B22DAA56
SHA-256:	E5D6AE792C4D22D401A30DD1F24118DF2154267300BD7F9E38162FB98E3EFF7F
SHA-512:	202D3E346FF4BAE93772E417B5459923ADAE84146B6B75283BAF4984A8C0D0A6599A83C934122C27C7613B6D6CE7F31D3FF894223E39E27B2BA94247FB431A8C
Malicious:	false
Preview:	MDMP..a..... .........$f............T...............h.......<................<..........`.......8...........T............$..............T...........@...............................................................................eJ..............GenuineIntel............T.......\|.....$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD6C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6404
Entropy (8bit):	3.7190486272296392
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbvuQ60tYvYnlFXiWqgaMOUB89btFsfBPm:R6l7wVeJvuQ60tYve9pBB89btFsfBPm
MD5:	0CD1666F3003711C8DD3FD50811D6FB5
SHA1:	BEDE74071B17C9648D3F87EE24459B9484ACFCB3
SHA-256:	8D97AEC127A8FF3B024E624B281FAC0D45A6377C6D8985D83AE3CC2120AA8858
SHA-512:	02A0A624BDE3FD866FE47908E9706F9984A2ADEAF33D7D3B16C50E78CBCF94D8B6F4693C1D7223E3BE45BF58918B3210D07EC6776AEF360ECB20F19333815236
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD8C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.476737460633103
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VY/Ym8M4JLJFS+q8vhUtTVgCTrd:uIjfYI7mm7VLJyKOtTVgCTrd
MD5:	E953B282E3672FA6104ED95F59394D77
SHA1:	191AF51F956978E4B17E02AF0C460E5B032D4D44
SHA-256:	0F45EA607B74A9BA3F12F147213A563D9370883C982056BDDABD0A31DDBD6A44
SHA-512:	5B0A472BFD2E04370CC5F83886433A28AD9AE0E29092517429396601CD8194C022FE209A6CEBDBB63318E9028A5E4F48A1998EDDE5F41172DBC2587CA7EFBC08
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFDD8.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:10 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	78834
Entropy (8bit):	2.137444898290961
Encrypted:	false
SSDEEP:	384:USD6X1ZSRTvLSpvYXXgRsUCdGIzLzGgJZAZfAYx3owzFvUqbaP:TU1ARTvLSpva2Q3zGgJVYx3oUMqWP
MD5:	203870B34BFE41E6A9C87BEA271EF8ED
SHA1:	C109C72339D0E70D46243FAEAE55A8A1E31BEFF4
SHA-256:	2DA23001FB9D878BEBC971DBBC77B8B3092E6329D550E99E678A257CC864B1FF
SHA-512:	C006CAC33DA594CDD7C6F9CE657E80C836FCA6EBB09F487863A1363BED3D1E4C79A20EC5D58DFF0D87760C96DFADB6F48B3BFF7690F312EAB631B76310AA9826
Malicious:	false
Preview:	MDMP..a..... .........$f............T...........D...h.......<................;..........`.......8...........T............#..B.......................................................................................................eJ......l.......GenuineIntel............T.......$.....$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE95.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6402
Entropy (8bit):	3.7238496735746494
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbmuk6ijjYvYnlFXiWqgaMOUt89btxsfGQPm:R6l7wVeJmuk6yYve9pBt89btxsf9Pm
MD5:	9A612BFE25981026A9E5E4C46051E5DC
SHA1:	2C1397C51A4D14DF85E8F498CF1BD10C29440AB7
SHA-256:	CC5D4976B966BD39E28B473615E5CDC77B2C96DEE305E6F101868DB15A49B9EB
SHA-512:	76BF6F2224AE305FB109BB20990E83F3DFDD39B7740180B9A31A389A2B58A5332651DD7D8AC10403DC930C07B46FEC2FD420A7145D2717A14DE249C43DA49C41
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFEC5.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.479676117661733
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9EXWpW8VY5Ym8M4JLJFIK+q8vhZTVgCTwd:uIjfYI7mm7VhJoKKTTVgCTwd
MD5:	F8F529F016D99F094C4D56FD5EE5C0CE
SHA1:	487800746FDD27C62848459DDA8661AA2696C70B
SHA-256:	67314B42312DD0B53FB8BB572773235E184C494D9113694C7E5F1ABBDD656CFF
SHA-512:	D99EC2696E89C7674C608A3664F2688B26FD400AD711D3D166EC48B44811B07D919537D5AAA83B853B5FCC52C8D40243755CA68F75C8D26D921379328499DB81
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="288547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFEC.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:10 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	92896
Entropy (8bit):	2.246041635005521
Encrypted:	false
SSDEEP:	384:GFexGTKsP1TvG7aO97WUzMMsgfZEbt6QD2/XpVYxa8cqeeRBYLgJpzI23++KuLmu:vx8KsP1TvQ9pxiEa0vYxa8cK3Y0Jp
MD5:	AC46DAEAAAA38BCA635334826E5511C1
SHA1:	B9F90E0737CD58FC142182FFB17E55DFBE19BBE3
SHA-256:	E15EB39076DC26BB5383E2135A1D54351495E9A217D2BB6314EBD6D67DF50CFF
SHA-512:	5392DEC06005E1E0E09C8EA4A7EB830171EFC06A962273780547DD1E5CD501FE66F39318FC34C3FDE838AB45575DE390DECAB45A7E7475BAF6E21FDF49E2B0F1
Malicious:	false
Preview:	MDMP..a..... .........$f....................................<...H............?..........`.......8...........T............*..(@......................p...............................................................................eJ....... ......GenuineIntel............T.......\|.....$f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	952832
Entropy (8bit):	7.663785344043907
Encrypted:	false
SSDEEP:	24576:3IwoFmXsR3sf1viW1V6T/uKWZUtH6z1o:YuosfYWH6zuKd6z
MD5:	A815D2D73A30DFCAB21000B326B29C13
SHA1:	B9EC12B977B9EE6ECDCB74C7E718AD4018755625
SHA-256:	9BA89A594158DCAD47219D1FFFC94D54CEAB08AA934DFAF80A9880FEFD3E3070
SHA-512:	8F0CAD5A685E5D6093F2A7C13B1EA3B7F3F267D72D95185621DC197031711E7D6EEBA589FB08F96CCD69F5801FA7573E4818EE226E23AA7E460578D827A5FE97
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 44%, Browse Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................W......h.Q.....i...................e-m......S....e-V....Rich...................PE..L...s.pd......................j.....w=............@..........................0k...../.......................................D\|..x.....i..\|..............................8....................q......xq..@............................................text............................... ..`.rdata...u.......v..................@..@.data.....h..........z..............@....rsrc....\|....i..\|..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\HZqMYfpyMfdfHfQja15Vpq6.zip

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5601
Entropy (8bit):	7.8974962445778685
Encrypted:	false
SSDEEP:	96:1WGzqeAoMq+YK0KF8cAJiI2i+unpwSJH5Z2gqAgqlr1WKTS3KJ14k:ZqASpF8wFEp9t5QgcqlcKTS6J14k
MD5:	6F65CE12654469D75AA3901797D3EB83
SHA1:	2B4633A2218410C5B016CFDD39BA021D0477C68E
SHA-256:	1EA731AA8876074047426D467164EE735E9962CD04084624BB8A026AF8DA099E
SHA-512:	0AF9A483AB4DF91B341B383480486220B0B9E0531D5FC6BCF55B4D3C22122F412885E7966ADC1D36968A34DEE6709DCBCDBB47FC019D9BA60C2EB080C8727C61
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\HZqMYfpyMfdfHfQja15Vpq6.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\adobejdT_84zuiGXP\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\adobejdT_84zuiGXP\information.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6414
Entropy (8bit):	5.306085065127627
Encrypted:	false
SSDEEP:	96:x3c2shZRsBLcT4Aisph+9hcmzGMO6B2LfwNz007ANUbg3x:x3ctuBLvAtphWhcmzGMK/B
MD5:	932D3735DEA54FAB51F01669F62617AE
SHA1:	9A9788A5DBA8B6732136FD69A13BE2CE5B8B2A16
SHA-256:	0606114DF3DBFFF17384089E9A53DF043D1F4C1ABADF7647499D9AA0E3CFD058
SHA-512:	6D9C79FFD449C84FC05EB6D2973F474F577A82AA5C4737B69563C73652CE5F3B60568B531429E77BCFC6C1A7B14C0FAC896D0C057685907F405749034C7E67EA
Malicious:	false
Preview:	Build: pivas..Version: 1.9....Date: Sat Apr 20 20:05:17 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 8c6034115eb0f9d8dd1b9d669a1c4d6a....Path: C:\Users\user\Desktop\file.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobejdT_84zuiGXP....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 910646 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/4/2024 20:5:17..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe [784]..svch

C:\Users\user\AppData\Local\Temp\adobejdT_84zuiGXP\passwords.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\adobepjTpZimyl6qo\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\adobepjTpZimyl6qo\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6383
Entropy (8bit):	5.30657485166248
Encrypted:	false
SSDEEP:	96:x3c2/FZRsocT4Aisph+9hcB9GtB2LfwNz00uzANUbg3x:x3c4uovAtphWhcB9Gm9gB
MD5:	17D2CB17F885FDF6A30685F1EA1DE3FB
SHA1:	0408EE557FE915F5F419CB72504376079AA1E39F
SHA-256:	53B88DEE7D9E35691BC0B1C423F9187AA7E7DBCBD3D0EFCD13FDFE8238D224D0
SHA-512:	44D795257E5AEE647DA4BD4FB1621D9A15C0ACA0BB43337AE51449D3715EF0AF7C29BC9524FE215C3EA110EE744EC56A2368D1C796F9A727EB549ACB824FCDCA
Malicious:	false
Preview:	Build: pivas..Version: 1.9....Date: Sat Apr 20 20:05:52 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 8c6034115eb0f9d8dd1b9d669a1c4d6a....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobepjTpZimyl6qo....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 910646 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/4/2024 20:5:52..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe [784].

C:\Users\user\AppData\Local\Temp\adobepjTpZimyl6qo\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\adobezQtRch0ZmSou\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\adobezQtRch0ZmSou\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6327
Entropy (8bit):	5.305820168098647
Encrypted:	false
SSDEEP:	96:x3c2osZRslcT4Aisph+9hcBzGtB2LfwNz000ANUbg3x:x3cSulvAtphWhcBzGm+B
MD5:	E76D5E824A2D5850CAAC4510FA9966BD
SHA1:	CF8FD91CB7CD043E8C29D0FE3F0C833BE783FEF0
SHA-256:	F9F267718D515837A071DD4732BD39A5F0E4BD1BCB3D796A0B4BE93FD93E5969
SHA-512:	11BBDB4043392248819C4FB7432C2F3CDB0FE52D907664E965FD237053D9A872BF1BEF952A6B026335C5BB9452CEA1E30E6D8F5DC690478D66D9E8D47BA20E1A
Malicious:	false
Preview:	Build: pivas..Version: 1.9....Date: Sat Apr 20 20:05:40 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 8c6034115eb0f9d8dd1b9d669a1c4d6a....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobezQtRch0ZmSou....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 910646 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/4/2024 20:5:40..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe [784].

C:\Users\user\AppData\Local\Temp\adobezQtRch0ZmSou\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ax62Lo_zBXq90uwBqgwbr3X.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5573
Entropy (8bit):	7.895179952697701
Encrypted:	false
SSDEEP:	96:1WGzqeAoMq+YK0KF8cAJiI2i+uiBwUbdXBp67fDygJndqsS3KJAhf:ZqASpF8wFnwMxp67fjJdqsS6JAl
MD5:	68CAC5522C15B46D4A5A7B9E0A412DBE
SHA1:	93EDA4D56BF44C46CBE9BEA43EB1E37327418A3E
SHA-256:	6016039A9C9C5183FA6DFC28F642EBC7485B66364634CB277D76CC2BF03F5365
SHA-512:	B38D67F4F0D165D464AB20CEB8C659FAEB739B9649EFD48F236CA113CF68A70040082DCDB8024B1864B640EC660DDAFF97F35128D2DA188E16092F0ADD02E41D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\ax62Lo_zBXq90uwBqgwbr3X.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\1FcP9eUeV0_qWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\79XSsViDXoczHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\8MhogtJMRILwHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\IO6Zwb2pZcpALogin Data For Account

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\IXC06WTABbSzCookies

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\Sbg9DSp7lstNHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\W5ItwnbOEWbrLogin Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\ZAfgfBvVuQKNWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\iTUZG7291Qb8Web Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\p5yNjy0gJTQpWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\s_jDytUw5zVDWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\thdijlfvXXi5History

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\trdFrTbEn6pPLogin Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\w6NCEqkWwTcAWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\14vKYSMfhshSLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\6GKpONOgQCQDWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\7CSy0IxQh1VlHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\CEYAAajxdr9QLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\MBYfBCnDVQSSHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\amggfY1X012lWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\fzOGBVhWIKhlHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\gyqRvWXIZE5OWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\iaBWdi4Fnhz1Web Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\njJisi0cnX_KWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\rdVUsVkL4QbQWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\sANT26gQMwt7History

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\sWrnFSWiPcWWCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\tTQUAdIiirY8Login Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\1xsvu65yyJa4Login Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\8HRycHnVbK4iWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\8ZJZxxoSigJTHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\Bu4fqjuvymtRLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\Gf8hzmQcfGHfWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\JDpwntiCRWhZWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\Lk65jVXnM3gHWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\TuqMWxaa7e_CCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\YbzjBYrL0NXcHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\Z2XBcxuCaxhxHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\bPe6T3UEPwG2Login Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\rdNYuR1GWMoBWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\uUNSZzd9cNCaHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\zgOZJSvD4T6RWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rTXApvaKL9yw6N5oqHITZ9U.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5574
Entropy (8bit):	7.90107412490964
Encrypted:	false
SSDEEP:	96:NWGzqeAoMq+YK0KF8cAJiI2i+uv8ga+qMoeSjzobVMTYxha12J2FO4YS3KJFz:BqASpF8wF3ga8DotZ2Jw3YS6JFz
MD5:	9EA8CCDAB65EA1279E8F9AFC64B834F8
SHA1:	B2A7D5CC83FC2DD071CA81B87704539D9303771C
SHA-256:	69B41DD8E1A3E7BE6388FE90CC546DB1DAE0A0B5313D4B5D0186C9991326978E
SHA-512:	5D862A1AC63946B5A8575B5DFD32BE38633DF407F29F32E6B04829163DE3917B2501D1E3117946FBE01C7D915FB29FFD8F2ED255A8BBBF835E8C8B89C5025411
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\rTXApvaKL9yw6N5oqHITZ9U.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.8731406795131336
Encrypted:	false
SSDEEP:	3:LFPn:F
MD5:	C531A007D40FE22B960BDA417324DF0F
SHA1:	E3ADD71DD28C5FE53D0F0F4EFEF254E3E2D10F9C
SHA-256:	9B45A51FFA2D964033D9660C1B5B903EE7CBB97F83D19D495DC84BC6770BB54B
SHA-512:	8681AB4C812C0C82808AB527F65AF19FD238438427DF754D79ECFB18AE555562AD4BFC69B6AE916273C9C96BF19D50B7E2DCEF7D2C3835FE374A3CAC8AAAF6CF
Malicious:	false
Preview:	1713640710385

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468177262588214
Encrypted:	false
SSDEEP:	6144:HIXfpi67eLPU9skLmb0b4aWSPKaJG8nAgejZMMhA2gX4WABl0uNYdwBCswSbf:oXD94aWlLZMM6YFH6+f
MD5:	F05DF382EEC1658FB1F7228C657C351F
SHA1:	C1666BED5DD35B588FF7FA2EFE8D1E8AE3D4749E
SHA-256:	2CEC4715598C1D91D2AF23F3C7C472D8261C2EF11DBF3B81614773B253CF0E8A
SHA-512:	AB04B029A8AF4DAECB70243A791718D034C6E54EB26DA6B65AFBBBBB4085FF2A7FC1F26586B77790B203B5275063DD64597376517C8C29B9C720B918E3C819D0
Malicious:	false
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm^..AM..................................................................................................................................................................................................................................................................................................................................................u........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.663785344043907
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	952'832 bytes
MD5:	a815d2d73a30dfcab21000b326b29c13
SHA1:	b9ec12b977b9ee6ecdcb74c7e718ad4018755625
SHA256:	9ba89a594158dcad47219d1fffc94d54ceab08aa934dfaf80a9880fefd3e3070
SHA512:	8f0cad5a685e5d6093f2a7c13b1ea3b7f3f267d72d95185621dc197031711e7d6eeba589fb08f96ccd69f5801fa7573e4818ee226e23aa7e460578d827a5fe97
SSDEEP:	24576:3IwoFmXsR3sf1viW1V6T/uKWZUtH6z1o:YuosfYWH6zuKd6z
TLSH:	7A15E00372E1BC64E66607329FAE95EC772EF8324E16BB2B32046E1F14B51B1C627751
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................W.......h.Q.....i.....................e-m.......S.....e-V.....Rich....................PE..L...s.pd...........

File Icon


Icon Hash:	51214951454d510d

Static PE Info

General

Entrypoint:	0x403d77
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6470A373 [Fri May 26 12:17:55 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	deee2f3ec985195fc99175dfed532c7c

Entrypoint Preview

Instruction
call 00007F980C928B68h
jmp 00007F980C921735h
push 00000014h
push 004177F0h
call 00007F980C925D58h
call 00007F980C928D39h
movzx esi, ax
push 00000002h
call 00007F980C928AFBh
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F980C921736h
xor ebx, ebx
jmp 00007F980C921765h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F980C92171Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F980C92170Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F980C92173Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F980C92554Eh
test eax, eax
jne 00007F980C92173Ah
push 0000001Ch
call 00007F980C921811h
pop ecx
call 00007F980C924D10h
test eax, eax
jne 00007F980C92173Ah
push 00000010h
call 00007F980C921800h
pop ecx
call 00007F980C928B74h
and dword ptr [ebp-04h], 00000000h
call 00007F980C927BEDh
test eax, eax
jns 00007F980C92173Ah
push 0000001Bh
call 00007F980C9217E6h
pop ecx
call dword ptr [004110C8h]
mov dword ptr [01A9A2E0h], eax
call 00007F980C928B8Fh
mov dword ptr [004D222Ch], eax
call 00007F980C928532h
test eax, eax
jns 00007F980C92173Ah

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17c44	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x169b000	0x17c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11210	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x171c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x17178	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x19c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfec5	0x10000	86dff270419606a8c033d898bc5a5d10	False	0.6038818359375	data	6.709261086285926	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x75d0	0x7600	f93394e81ff6f547570554b6c945600d	False	0.3950278072033898	data	4.946788083409842	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19000	0x16812e4	0xb9400	c94b71d46f354f377c3413be1393db0a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x169b000	0x17c00	0x17c00	b9c61ed5d555a298d5c017c8df29e781	False	0.3187088815789474	data	4.1399004439858045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x16adae0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x16ae988	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x16af230	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_CURSOR	0x16af7c8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x16af8f8	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x16af9d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x16b0878	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x16b1120	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_ICON	0x169b8d0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.41359447004608296
RT_ICON	0x169bf98	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.16524896265560166
RT_ICON	0x169e540	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.2154255319148936
RT_ICON	0x169e9d8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.41359447004608296
RT_ICON	0x169f0a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.16524896265560166
RT_ICON	0x16a1648	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.2154255319148936
RT_ICON	0x16a1ae0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.37100213219616207
RT_ICON	0x16a2988	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.45306859205776173
RT_ICON	0x16a3230	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.4619815668202765
RT_ICON	0x16a38f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.45664739884393063
RT_ICON	0x16a3e60	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.2691908713692946
RT_ICON	0x16a6408	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.3062851782363977
RT_ICON	0x16a74b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.350177304964539
RT_ICON	0x16a7980	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.5674307036247335
RT_ICON	0x16a8828	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.5469314079422383
RT_ICON	0x16a90d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.6105491329479769
RT_ICON	0x16a9638	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46307053941908716
RT_ICON	0x16abbe0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4901500938086304
RT_ICON	0x16acc88	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.49385245901639346
RT_ICON	0x16ad610	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.4530141843971631
RT_DIALOG	0x16b18a8	0x52	data			0.8780487804878049
RT_STRING	0x16b1900	0x3d2	data	Romanian	Romania	0.4539877300613497
RT_STRING	0x16b1cd8	0x32a	data	Romanian	Romania	0.47901234567901235
RT_STRING	0x16b2008	0x1a8	data	Romanian	Romania	0.49528301886792453
RT_STRING	0x16b21b0	0x30a	data	Romanian	Romania	0.47429305912596403
RT_STRING	0x16b24c0	0x534	data	Romanian	Romania	0.44744744744744747
RT_STRING	0x16b29f8	0x208	data	Romanian	Romania	0.5038461538461538
RT_GROUP_CURSOR	0x16af798	0x30	data			0.9375
RT_GROUP_CURSOR	0x16af9a8	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x16b1688	0x30	data			0.9375
RT_GROUP_ICON	0x16ada78	0x68	data	Romanian	Romania	0.7115384615384616
RT_GROUP_ICON	0x169e9a8	0x30	data	Romanian	Romania	0.9375
RT_GROUP_ICON	0x16a7918	0x68	data	Romanian	Romania	0.7115384615384616
RT_GROUP_ICON	0x16a1ab0	0x30	data	Romanian	Romania	1.0
RT_VERSION	0x16b16b8	0x1ec	data			0.5386178861788617

Imports

DLL	Import
KERNEL32.dll	LocalCompact, GetUserDefaultLCID, AddConsoleAliasW, CreateHardLinkA, GetTickCount, GetWindowsDirectoryA, EnumTimeFormatsW, FindResourceExA, GetVolumeInformationA, LoadLibraryW, ReadConsoleInputA, CopyFileW, WriteConsoleW, GetCompressedFileSizeA, GetTempPathW, SetThreadLocale, GetLastError, SetLastError, GetProcAddress, GetLocaleInfoA, CreateTimerQueueTimer, SetStdHandle, SetFileAttributesA, WriteConsoleA, InterlockedExchangeAdd, LocalAlloc, SetCalendarInfoW, GetExitCodeThread, RemoveDirectoryW, AddAtomA, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, LoadLibraryExA, AddConsoleAliasA, OutputDebugStringW, GetComputerNameA, FindFirstChangeNotificationW, GetSystemDefaultLangID, FlushFileBuffers, GetConsoleMode, HeapFree, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsValidCodePage, GetACP, GetCPInfo, GetCurrentThreadId, IsDebuggerPresent, GetProcessHeap, ExitProcess, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, HeapSize, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, HeapAlloc, WriteFile, GetModuleFileNameW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, GetStringTypeW, LoadLibraryExW, HeapReAlloc, ReadFile, SetFilePointerEx, LCMapStringW, GetConsoleCP, CreateFileW
USER32.dll	GetMenuItemID
GDI32.dll	GetCharacterPlacementW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpConnect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/20/24-20:05:38.687787	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49731	58709	192.168.2.4	147.45.47.93
04/20/24-20:05:02.409597	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49730	147.45.47.93	192.168.2.4
04/20/24-20:05:01.031788	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49730	147.45.47.93	192.168.2.4
04/20/24-20:05:05.549113	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49730	58709	192.168.2.4	147.45.47.93
04/20/24-20:05:58.481493	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49745	58709	192.168.2.4	147.45.47.93
04/20/24-20:05:00.821645	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49730	58709	192.168.2.4	147.45.47.93
04/20/24-20:05:05.669470	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49732	147.45.47.93	192.168.2.4
04/20/24-20:05:03.174322	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49731	147.45.47.93	192.168.2.4
04/20/24-20:05:08.957422	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49731	147.45.47.93	192.168.2.4
04/20/24-20:05:09.034376	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49732	147.45.47.93	192.168.2.4
04/20/24-20:05:54.187156	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49744	58709	192.168.2.4	147.45.47.93
04/20/24-20:05:24.937277	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49745	147.45.47.93	192.168.2.4
04/20/24-20:05:41.718793	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49732	58709	192.168.2.4	147.45.47.93
04/20/24-20:05:19.057028	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49744	147.45.47.93	192.168.2.4
04/20/24-20:05:25.800661	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49744	147.45.47.93	192.168.2.4
04/20/24-20:05:36.860964	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49745	147.45.47.93	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 20:05:00.592822075 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:00.812136889 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:00.812546968 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:00.821645021 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:01.031788111 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:01.078185081 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:01.087111950 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:02.409596920 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:02.453140020 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:02.729912043 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:02.951994896 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:02.952207088 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:02.958648920 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:03.174321890 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:03.227992058 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:03.234409094 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:05.224961042 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:05.447334051 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:05.447448015 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:05.458527088 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:05.549113035 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:05.572334051 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:05.572387934 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:05.572460890 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:05.575635910 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:05.575653076 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:05.669470072 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:05.718667984 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:05.727941990 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:05.801635027 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:05.801696062 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:05.804970980 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:05.804977894 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:05.805393934 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:05.821764946 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:06.015539885 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:06.297142982 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:06.571551085 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:06.632688046 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:06.680119038 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:06.771306992 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:06.771509886 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:06.771554947 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:06.774422884 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:06.774446011 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:06.774457932 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:06.774462938 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:06.885721922 CEST	49734	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:06.885749102 CEST	443	49734	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:06.885907888 CEST	49734	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:06.886132956 CEST	49734	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:06.886143923 CEST	443	49734	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:07.113073111 CEST	443	49734	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:07.113118887 CEST	49734	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:07.314233065 CEST	49734	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:07.314259052 CEST	443	49734	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:07.314737082 CEST	443	49734	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:07.316426992 CEST	49734	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:07.364113092 CEST	443	49734	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:07.369251013 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:07.421808958 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:07.528328896 CEST	443	49734	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:07.528420925 CEST	443	49734	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:07.528589964 CEST	49734	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:07.528635979 CEST	49734	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:07.528650045 CEST	443	49734	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:07.528660059 CEST	49734	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:07.528664112 CEST	443	49734	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:07.529086113 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:07.790594101 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:08.781502008 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:08.919464111 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:08.953768969 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:08.957422018 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:09.000066996 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:09.034375906 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:09.078130960 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:09.227838039 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:10.544751883 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:10.558913946 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:10.593800068 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:10.594162941 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:10.609414101 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:10.635179996 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:10.687438011 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:10.868293047 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.203247070 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.203311920 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.203353882 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.203394890 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.203437090 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.203476906 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.203517914 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.203537941 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:12.203537941 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:12.203537941 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:12.203555107 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.203593016 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.203634977 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.203655958 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:12.203679085 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:12.213227987 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.328243017 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:12.422771931 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.422833920 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.422873020 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.422909021 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.422955990 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.423058033 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:12.423058033 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:12.487442970 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:12.759371042 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.837333918 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:12.890568972 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:13.061140060 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:13.109435081 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:13.156733036 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:13.431091070 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:13.856669903 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:13.937452078 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:14.160016060 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:14.250082016 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:14.515003920 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:14.624835968 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:14.701076031 CEST	49735	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:14.701136112 CEST	443	49735	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:14.701199055 CEST	49735	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:14.702214956 CEST	49735	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:14.702229977 CEST	443	49735	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:14.774610043 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:14.786322117 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:14.802175045 CEST	49736	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:14.802254915 CEST	443	49736	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:14.802639961 CEST	49736	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:14.803544044 CEST	49736	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:14.803627014 CEST	443	49736	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:14.899503946 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:14.918118000 CEST	443	49735	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:14.918246984 CEST	49735	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:14.919589043 CEST	49735	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:14.919609070 CEST	443	49735	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:14.919929981 CEST	443	49735	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:15.020174980 CEST	443	49736	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:15.020387888 CEST	49736	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:15.021471977 CEST	49736	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:15.021522999 CEST	443	49736	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:15.021795034 CEST	443	49736	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:15.031188011 CEST	49735	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:15.056313992 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:15.125000000 CEST	49736	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:15.559353113 CEST	49735	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:15.604113102 CEST	443	49735	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:15.691047907 CEST	443	49735	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:15.691143990 CEST	443	49735	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:15.691220999 CEST	49735	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:15.691725969 CEST	49735	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:15.691744089 CEST	443	49735	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:15.691759109 CEST	49735	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:15.691766024 CEST	443	49735	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:15.708950043 CEST	49737	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:15.709029913 CEST	443	49737	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:15.709136009 CEST	49737	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:15.709630966 CEST	49737	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:15.709661007 CEST	443	49737	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:15.845273972 CEST	49736	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:15.892199039 CEST	443	49736	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:15.927862883 CEST	443	49737	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:15.927978039 CEST	49737	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:15.983365059 CEST	443	49736	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:15.983438969 CEST	443	49736	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:15.983683109 CEST	49736	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:15.983829021 CEST	49736	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:15.983872890 CEST	443	49736	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:15.983908892 CEST	49736	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:15.983922958 CEST	443	49736	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:16.009170055 CEST	49739	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:16.009237051 CEST	443	49739	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:16.009351969 CEST	49739	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:16.009625912 CEST	49739	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:16.009663105 CEST	443	49739	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:16.226991892 CEST	443	49739	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:16.227210999 CEST	49739	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:16.228256941 CEST	49739	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:16.228308916 CEST	443	49739	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:16.228553057 CEST	443	49739	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:16.232228994 CEST	49739	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:16.276206017 CEST	443	49739	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:16.554697990 CEST	443	49739	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:16.554790974 CEST	443	49739	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:16.554935932 CEST	49739	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:16.555531025 CEST	49739	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:16.555531025 CEST	49739	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:16.555561066 CEST	443	49739	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:16.555578947 CEST	443	49739	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:16.556015968 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:16.821800947 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:17.075553894 CEST	49737	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:17.075633049 CEST	443	49737	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:17.075968981 CEST	443	49737	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:17.077853918 CEST	49737	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:17.124157906 CEST	443	49737	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:17.289472103 CEST	443	49737	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:17.289557934 CEST	443	49737	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:17.290051937 CEST	49737	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:17.290052891 CEST	49737	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:17.290199041 CEST	49737	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:17.290242910 CEST	443	49737	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:17.290303946 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:17.556082010 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:18.559233904 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:18.605547905 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:18.610527039 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:18.618350029 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:18.672693968 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:18.837574005 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:18.837827921 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:18.845947981 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:18.899876118 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:18.946363926 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:19.057028055 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:19.118823051 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:19.234306097 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:21.622400999 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:21.672112942 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:21.946896076 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:22.188374043 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:22.356904030 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:22.391015053 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:22.462884903 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:22.665370941 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:24.289180040 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:24.289180040 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:24.492635012 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:24.509020090 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:24.509079933 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:24.509118080 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:24.509211063 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:24.715024948 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:24.715198040 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:24.720381021 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:24.775298119 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:24.937277079 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:24.993798018 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:25.117311954 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:25.800661087 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:25.843689919 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:25.922377110 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:25.922437906 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:25.922478914 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:25.922517061 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:25.922558069 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:25.922596931 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:25.922621965 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:25.922622919 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:25.922636986 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:25.922678947 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:25.922689915 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:25.922715902 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:25.922755957 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:25.922784090 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:25.922813892 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:26.145004034 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.145070076 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.145109892 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.145148993 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.145191908 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.145374060 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:26.145374060 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:26.156248093 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:26.431113005 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.562532902 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.562592030 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.562629938 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.562643051 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:26.562669039 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.562711954 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.562724113 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:26.562752008 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.562792063 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.562810898 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:26.562830925 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.562869072 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.562877893 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:26.562908888 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.562952042 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:26.784920931 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.784986973 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.785027981 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.785034895 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:26.785068989 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.785110950 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:26.785120010 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:26.828066111 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:26.875025988 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:27.150058985 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:27.328183889 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:27.521495104 CEST	49746	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:27.521588087 CEST	443	49746	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:27.521670103 CEST	49746	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:27.522532940 CEST	49746	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:27.522567034 CEST	443	49746	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:27.547245026 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:27.737788916 CEST	443	49746	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:27.737849951 CEST	49746	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:27.741353989 CEST	49746	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:27.741362095 CEST	443	49746	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:27.741610050 CEST	443	49746	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:27.791208982 CEST	49746	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:27.832195044 CEST	443	49746	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:27.978679895 CEST	443	49746	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:27.978775024 CEST	443	49746	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:27.978981972 CEST	49746	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:27.979300022 CEST	49746	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:27.979314089 CEST	443	49746	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:27.979376078 CEST	49746	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:27.979381084 CEST	443	49746	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:27.981129885 CEST	49747	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:27.981230974 CEST	443	49747	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:27.981364012 CEST	49747	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:27.981796026 CEST	49747	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:27.981832027 CEST	443	49747	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:28.078227997 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:28.198338032 CEST	443	49747	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:28.198437929 CEST	49747	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:28.353018999 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:28.416518927 CEST	49747	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:28.416563988 CEST	443	49747	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:28.416899920 CEST	443	49747	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:28.418101072 CEST	49747	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:28.460196972 CEST	443	49747	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:28.638519049 CEST	443	49747	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:28.638590097 CEST	443	49747	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:28.638644934 CEST	49747	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:28.638894081 CEST	49747	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:28.638943911 CEST	443	49747	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:28.638978958 CEST	49747	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:28.638995886 CEST	443	49747	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:28.639414072 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:28.899910927 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:36.806480885 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:36.859436989 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:36.860964060 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:36.906280041 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:36.935277939 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:36.953218937 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:37.228141069 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:37.729942083 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:37.776892900 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:37.781207085 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:37.828121901 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:37.828335047 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:38.087843895 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:38.590643883 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:38.640580893 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:38.687787056 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:38.808233023 CEST	49755	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:38.808270931 CEST	443	49755	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:38.808413982 CEST	49755	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:38.809505939 CEST	49755	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:38.809518099 CEST	443	49755	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:38.962263107 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:39.025217056 CEST	443	49755	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:39.025290966 CEST	49755	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:39.027862072 CEST	49755	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:39.027879953 CEST	443	49755	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:39.028141975 CEST	443	49755	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:39.078072071 CEST	49755	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:39.356894970 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:39.359534025 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:39.368705988 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:39.421184063 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:39.607888937 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:39.618601084 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:39.656229973 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:39.687803984 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:39.938160896 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:39.957185030 CEST	49755	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:39.962274075 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:40.004122019 CEST	443	49755	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:40.091268063 CEST	443	49755	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:40.091383934 CEST	443	49755	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:40.091435909 CEST	49755	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:40.093992949 CEST	49755	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:40.094038010 CEST	443	49755	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:40.094065905 CEST	49755	443	192.168.2.4	34.117.186.192
Apr 20, 2024 20:05:40.094082117 CEST	443	49755	34.117.186.192	192.168.2.4
Apr 20, 2024 20:05:40.134289980 CEST	49756	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:40.134368896 CEST	443	49756	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:40.134666920 CEST	49756	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:40.135384083 CEST	49756	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:40.135461092 CEST	443	49756	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:40.212251902 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:40.357064009 CEST	443	49756	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:40.357347012 CEST	49756	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:40.358618021 CEST	49756	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:40.358669996 CEST	443	49756	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:40.359025002 CEST	443	49756	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:40.363246918 CEST	49756	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:40.404195070 CEST	443	49756	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:40.706352949 CEST	443	49756	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:40.706590891 CEST	443	49756	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:40.706806898 CEST	49756	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:40.906616926 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:40.906678915 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:40.906719923 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:40.906758070 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:40.906800032 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:40.906837940 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:40.906857967 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:40.906857967 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:40.906877041 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:40.906893969 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:40.906971931 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:40.907011986 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:40.907052994 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:40.907077074 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:40.907098055 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:41.126111031 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:41.126173973 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:41.126213074 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:41.126250982 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:41.126266956 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:41.126292944 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:41.126352072 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:41.218792915 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:41.234637976 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:41.235663891 CEST	49756	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:41.235665083 CEST	49756	443	192.168.2.4	104.26.4.15
Apr 20, 2024 20:05:41.235726118 CEST	443	49756	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:41.235760927 CEST	443	49756	104.26.4.15	192.168.2.4
Apr 20, 2024 20:05:41.236116886 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:41.493942022 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:41.508902073 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:41.718792915 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:41.993412018 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:42.167068005 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:42.218704939 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:42.638851881 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:42.656477928 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:42.734570980 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:42.765707016 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:42.885303020 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:42.931155920 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:42.965229988 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:43.040242910 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.227734089 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.248991013 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.296715021 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.312458038 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:43.328217983 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:43.602905989 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.762845993 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.768868923 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.768940926 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.768981934 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.769013882 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:43.769018888 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.769057989 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.769083977 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:43.769095898 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.769135952 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.769172907 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.769186974 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:43.769218922 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.769238949 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:43.769263029 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.769315004 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:43.886292934 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:43.991425037 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.991488934 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.991528988 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.991569042 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.991595030 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:43.991614103 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:43.991667986 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:44.093735933 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:44.149909019 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:44.329695940 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:44.421825886 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:44.422189951 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:44.655086040 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:44.718692064 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:45.104053974 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:45.218703032 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:45.856800079 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:45.931400061 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:45.931607962 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:46.015686035 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:46.238287926 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:46.407896996 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:46.823947906 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:47.087510109 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:54.187155962 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:54.416903973 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:54.515624046 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:55.485889912 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:55.485963106 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:55.707427979 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:55.707488060 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:55.707504988 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:55.707632065 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:55.977864981 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:58.481492996 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:58.547014952 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:05:58.743550062 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:05:58.768567085 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:01.058022976 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:01.109337091 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:03.796230078 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:03.796622038 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:04.018802881 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:04.018831968 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:04.019002914 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:04.019117117 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:04.130776882 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:04.130834103 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:04.290529966 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:04.350023031 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:04.350080967 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:04.350119114 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:04.350209951 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:04.618261099 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:06.844000101 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:07.066221952 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:07.140851021 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:07.360308886 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:07.894715071 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:07.894886971 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:08.116686106 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:08.116708994 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:08.116777897 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:08.116893053 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:08.384418011 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:08.916395903 CEST	58709	49744	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:08.916457891 CEST	49744	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:09.400269032 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:09.400418997 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:09.665484905 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:10.906255960 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:11.128405094 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:11.135700941 CEST	58709	49745	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:11.135776997 CEST	49745	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:39.931180000 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:39.931246042 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 20, 2024 20:06:39.931432009 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 20, 2024 20:06:39.931478977 CEST	49731	58709	192.168.2.4	147.45.47.93

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 20:05:05.461889029 CEST	50119	53	192.168.2.4	1.1.1.1
Apr 20, 2024 20:05:05.567878962 CEST	53	50119	1.1.1.1	192.168.2.4
Apr 20, 2024 20:05:06.776537895 CEST	52463	53	192.168.2.4	1.1.1.1
Apr 20, 2024 20:05:06.884068966 CEST	53	52463	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 20, 2024 20:05:05.461889029 CEST	192.168.2.4	1.1.1.1	0x6658	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Apr 20, 2024 20:05:06.776537895 CEST	192.168.2.4	1.1.1.1	0xfcc8	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 20, 2024 20:05:05.567878962 CEST	1.1.1.1	192.168.2.4	0x6658	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Apr 20, 2024 20:05:06.884068966 CEST	1.1.1.1	192.168.2.4	0xfcc8	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
Apr 20, 2024 20:05:06.884068966 CEST	1.1.1.1	192.168.2.4	0xfcc8	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
Apr 20, 2024 20:05:06.884068966 CEST	1.1.1.1	192.168.2.4	0xfcc8	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	34.117.186.192	443	7448	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 18:05:06 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-20 18:05:06 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sat, 20 Apr 2024 18:05:06 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 6 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-20 18:05:06 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-20 18:05:06 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	104.26.4.15	443	7448	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 18:05:07 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-20 18:05:07 UTC	654	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 18:05:07 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471E7A:A9D4_93878F2E:0050_662403D3_9151A5E:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QOkwGvh0Dwp22mp1xyYqnbCURXwOYrVyNzUtOu9r6XqnhNtGxIsvhNluI%2FFiID%2FI6ghsjsVBKjpBh6Kj8qz%2FdxcfJt7phDKvdyTxTqBOjKvHIPhpKCVsLXeUmg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87770f89095753c7-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 18:05:07 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-20 18:05:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	34.117.186.192	443	7548	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 18:05:15 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-20 18:05:15 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sat, 20 Apr 2024 18:05:15 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-20 18:05:15 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-20 18:05:15 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	34.117.186.192	443	7716	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 18:05:15 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-20 18:05:15 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sat, 20 Apr 2024 18:05:15 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 4 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-20 18:05:15 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-20 18:05:15 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	104.26.4.15	443	7716	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 18:05:16 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-20 18:05:16 UTC	648	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 18:05:16 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC454655:40C6_93878F2E:0050_662403DC_912A5F7:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Z7RkVvFmJbxTrn8V1Xaxss00ihDEudugiIPhX0Cxwr3QBuRGRvN9snjExgXPKMUFFwFqgzZpvEVl2rCNyNmzlo4scFCAPHy5BUHITznSubcM3eIqOUpDwu6AA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87770fc1ab36458e-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 18:05:16 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-20 18:05:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49737	104.26.4.15	443	7548	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 18:05:17 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-20 18:05:17 UTC	650	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 18:05:17 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471635:474A_93878F2E:0050_662403DD_9151B27:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eBDRKwxKiUMhpvzyxIEKdtGhOOjh8PbN3Wl6Vf2OSgI7Guv0XEKIIqDig3AmmHP19s13cekwbF7Hn5C1nJ3mn6Dhx2OXlrPDh4wR3pccr2QYWdhdect%2BlAwmfw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87770fc61ef8b0bd-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 18:05:17 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-20 18:05:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49746	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-04-20 18:05:27 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-20 18:05:27 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sat, 20 Apr 2024 18:05:27 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-20 18:05:27 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-20 18:05:27 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49747	104.26.4.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-20 18:05:28 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-20 18:05:28 UTC	652	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 18:05:28 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC47162E:98E2_93878F2E:0050_662403E8_9151C23:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Au7KmrDDLd2fWJe0YBM9q7k42WGAGN7q7AKNAyQb0Pq3H85rDBrnvUJhwd55NYyx%2BMnv%2FqHoWnuonL8RlSR3xyQ9lthdHyyCtPpfCdjkcrpoJr6PbgMvngYJvQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8777100cfeb9b066-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 18:05:28 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-20 18:05:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49755	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-04-20 18:05:39 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-20 18:05:40 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sat, 20 Apr 2024 18:05:40 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-20 18:05:40 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-20 18:05:40 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49756	104.26.4.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-20 18:05:40 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-20 18:05:40 UTC	654	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 18:05:40 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471ED6:D8D2_93878F2E:0050_662403F4_912A7EB:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vVYTfb6LYeLEDxWNuwFDt%2BT4azn7KIelNYLsZm8V2rQxsFZw8VsY%2FLpQe0Vh0T6%2BuMpm66S556yI7jAjoJweCqixSWcytCS0ObDNqZN3DO1bfbSR4Gygb1mmJQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877710587e41add2-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 18:05:40 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-20 18:05:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:04:56
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	952'832 bytes
MD5 hash:	A815D2D73A30DFCAB21000B326B29C13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2081219970.000000000370D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2081934645.0000000006720000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2081435300.0000000003890000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1666330206.00000000039F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:04:58
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x950000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:04:58
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:04:58
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x950000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:04:58
Start date:	20/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	952'832 bytes
MD5 hash:	A815D2D73A30DFCAB21000B326B29C13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000004.00000002.2374176971.0000000006728000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000004.00000002.2371863766.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.2373416291.0000000003707000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000004.00000003.1684180987.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000004.00000002.2370794973.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.2373632178.00000000038E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs Detection: 44%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:04:58
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:04:58
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 848
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:05:00
Start date:	20/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	952'832 bytes
MD5 hash:	A815D2D73A30DFCAB21000B326B29C13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.2305457236.00000000035A1000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000002.2304201006.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000009.00000002.2305705773.0000000003830000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000002.2306103257.0000000006730000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2305000838.0000000001C95000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000003.1705537281.0000000003990000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:05:01
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 808
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:05:01
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 960
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	20:05:02
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 972
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	20:05:02
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 976
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:05:03
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 776
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	20:05:03
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 976
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	20:05:04
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 1396
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	20:05:05
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 996
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	20:05:07
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 920
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	20:05:08
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 888
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	20:05:08
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 908
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	20:05:08
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 884
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	20:05:09
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 936
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	20:05:09
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 900
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	20:05:10
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 936
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	20:05:10
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 908
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	26.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	42.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	118

Executed Functions

Function 00442940 Relevance: 218.3, APIs: 40, Strings: 83, Instructions: 3075fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 00442C53
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442CAF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004434EF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443639
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 004436EF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0044383A
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 004438D6
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443A09
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443AA4
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443BFE
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443C97
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443ED8
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444039
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00444292
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,00000000), ref: 00444416
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0044483E
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444898
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444A1E
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444CE4
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00444E4E
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444B76

Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B24F
Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B260

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00445C65
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00445CC0
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0044337F

Part of subcall function 0040E7B0: FindFirstFileA.KERNEL32(00000000,7F7A790F,?,7F7A790E,00445E27,00000000,7F7A790E,7F7A790F,74DF3100,?), ref: 0040E929

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442CE0

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442E08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442E37
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00442F2F
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443029
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443087
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004431B8
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0044324A

Strings

?)/, xrefs: 004447F9
864, xrefs: 00444D02
w Y_[], xrefs: 004445DC, 004445E2
315, xrefs: 00442CF2
34*8, xrefs: 0044320A
?(, xrefs: 0044527D
)u(%, xrefs: 00443BAE
.4.<, xrefs: 00444EA6
2, xrefs: 0044597E
t224, xrefs: 00442EE6
9"6-, xrefs: 00445A3C
%1, xrefs: 0044455F
.4.<, xrefs: 00444E0C
7;x, xrefs: 00444E9A
&2, xrefs: 0044485C
1<:3, xrefs: 00443E3F
|76, xrefs: 00445641
*, xrefs: 00443BB8
|::<, xrefs: 0044562A, 0044562D
"83<, xrefs: 00444520
?), xrefs: 004436B9
</, xrefs: 00443214
.4.<, xrefs: 00444DAA
?(, xrefs: 00445195
6:, xrefs: 00442C7A
759*, xrefs: 004451E3
315, xrefs: 00442C70
759*, xrefs: 00445271
k, xrefs: 00444B9A
3:, xrefs: 00443051
_, xrefs: 00444676
&+, xrefs: 00444534
9:, xrefs: 00444EB0
7:, xrefs: 00443FFD
9"6-, xrefs: 0044596A
"?=+, xrefs: 0044388C
4(r), xrefs: 0044452A
)u$0, xrefs: 004459E8
7;x, xrefs: 00444DA0
!#7), xrefs: 00443047
)u6., xrefs: 004439BF
1>6, xrefs: 00445807
0>?, xrefs: 00444477
9:, xrefs: 00444E16
0(33, xrefs: 004452EE
6:, xrefs: 00442CFC
11, xrefs: 004439C9
0>?, xrefs: 004443CF
4>(, xrefs: 00443CBF
759*, xrefs: 0044518B
;26-, xrefs: 004449D9
! 2;, xrefs: 0044420F, 00444212
864, xrefs: 00444CA1
3>2), xrefs: 00443A65
?0, xrefs: 00443E49
0>?w, xrefs: 004452E4
9"6-, xrefs: 00443BA4
1,), xrefs: 00442EDC
0(33, xrefs: 00445369
9"6-, xrefs: 004439B5
3$, xrefs: 00442FEB
!'14;y=!?, xrefs: 004429C4, 004429ED
$'4<, xrefs: 0044585E
";=w, xrefs: 00443CB5
?(, xrefs: 004451ED
9:, xrefs: 00444DB4
0+, xrefs: 004438A0
., xrefs: 00443172
4>(, xrefs: 00443C5A
#9;1, xrefs: 004436AF
)u$0, xrefs: 00445974
0>?, xrefs: 00444374
7;x, xrefs: 00444E02
0>?w, xrefs: 0044535F
+, xrefs: 00445E83
|';-, xrefs: 004455FF, 00445602
";=w, xrefs: 00443C50
%26>, xrefs: 004447EF
3y<8, xrefs: 00443168
ghi, xrefs: 00444B90
2, xrefs: 004459F2
9"6-, xrefs: 004459DE
61, xrefs: 00443E15

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateDirectory$File$Copy$Cpp_errorFolderPathThrow_std::_$AttributesErrorFindFirstLast
String ID: 1,)$ghi$! 2;$!#7)$!'14;y=!?$"83<$";=w$";=w$"?=+$#9;1$$'4<$%1$%26>$&+$&2$)u$0$)u$0$)u(%$)u6.$*$+$.$.4.<$.4.<$.4.<$0(33$0(33$0+$0>?$0>?$0>?$0>?w$0>?w$11$1<:3$1>6$2$2$315$315$3$$34*8$3:$3>2)$3y<8$4(r)$4>($4>($61$6:$6:$759*$759*$759*$7:$7;x$7;x$7;x$864$864$9"6-$9"6-$9"6-$9"6-$9"6-$9:$9:$9:$;26-$</$?($?($?($?)$?)/$?0$_$k$t224$w Y_[]$|';-$|76$|::<
API String ID: 2574188035-1442773133
Opcode ID: 84ae1c63d6033ff848180c2086d45f63427aa1eaa9acf33f2040efccea7c3d40
Instruction ID: 381145703412e6fb88b60a60e01735f5d7b95eb576607faa1d3520efd2827bc4
Opcode Fuzzy Hash: 84ae1c63d6033ff848180c2086d45f63427aa1eaa9acf33f2040efccea7c3d40
Instruction Fuzzy Hash: 56639E70C04298DADB21EB65CD557DEBBB4AF21308F4441DAD449772C2EBB81B88CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0041AB90 Relevance: 218.0, Strings: 173, Instructions: 1711
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

s, xrefs: 0041C164
1, xrefs: 0041BD9C
5, xrefs: 0041B5A4
8, xrefs: 0041B5C7
9, xrefs: 0041BC72
1<!;"%!, xrefs: 0041C5E4
5, xrefs: 0041C156
O, xrefs: 0041BB13
9, xrefs: 0041BE5F
;#, xrefs: 0041ADED
H, xrefs: 0041C1AA
$, xrefs: 0041C11E
; ;58<<, xrefs: 0041C644
;, xrefs: 0041B1A1
6, xrefs: 0041BF29
", xrefs: 0041BCE0
3, xrefs: 0041BB05
4, xrefs: 0041B5B9
3, xrefs: 0041C14F
;, xrefs: 0041BADB
Content-Type: application/x-www-form-urlencoded, xrefs: 0041ACC6, 0041AFE0, 0041BA6B
>, xrefs: 0041BD66
M, xrefs: 0041B5DC
>, xrefs: 0041BF22
9, xrefs: 0041BC0B
!, xrefs: 0041BDC6
0, xrefs: 0041BB0C
#, xrefs: 0041C125
[, xrefs: 0041C1B8
1: ,, xrefs: 0041B916
6, xrefs: 0041BAB1
>, xrefs: 0041BC8E
t, xrefs: 0041B5AB
], xrefs: 0041B096
<, xrefs: 0041BDA3
https://ipinfo.io/, xrefs: 0041B502
; ;58<<, xrefs: 0041C417
6, xrefs: 0041BD43
D, xrefs: 0041C1BF
3, xrefs: 0041B026
;, xrefs: 0041C133
;, xrefs: 0041B56C
!, xrefs: 0041BCD2
62 4, xrefs: 0041B8D2
y, xrefs: 0041BABF
#, xrefs: 0041B02D
1<!;"%!, xrefs: 0041C473
6, xrefs: 0041BD6D
%, xrefs: 0041B06C
V, xrefs: 0041BB60
9, xrefs: 0041BDE2
9 6, xrefs: 0041CEA9
=, xrefs: 0041B034
3#={;.1)t830q, xrefs: 0041AD3A
s, xrefs: 0041B073
;, xrefs: 0041B1CB
:, xrefs: 0041BD51
6, xrefs: 0041BC04
N, xrefs: 0041C180
#, xrefs: 0041B1CF
62 4, xrefs: 0041B6B2
8, xrefs: 0041C15D
;, xrefs: 0041BCD9
;#;#, xrefs: 0041AE29
6, xrefs: 0041BC2E
:, xrefs: 0041BC12
>, xrefs: 0041BE7B
62 4, xrefs: 0041B773
%, xrefs: 0041BCE7
Z, xrefs: 0041C1C6
&, xrefs: 0041BACD
6, xrefs: 0041BBFD
9, xrefs: 0041BD5F
c, xrefs: 0041B03B
", xrefs: 0041BDB8
6, xrefs: 0041BD3C
6, xrefs: 0041BC95
1: ,, xrefs: 0041C51A
c}e{, xrefs: 0041CE24
>, xrefs: 0041BC27
1, xrefs: 0041B07A
8, xrefs: 0041BAFE
=, xrefs: 0041C584
6, xrefs: 0041BEF8
=, xrefs: 0041C16B
9, xrefs: 0041BC87
1<!;, xrefs: 0041CCCA
#, xrefs: 0041B573
%, xrefs: 0041BDBF
;, xrefs: 0041BDB1
4, xrefs: 0041C148
{, xrefs: 0041C12C
3, xrefs: 0041B05E
1<!;"%!, xrefs: 0041C3B7
=, xrefs: 0041B065
1: ,, xrefs: 0041CD60
H, xrefs: 0041B5FF
%, xrefs: 0041C117
, xrefs: 0041C141
10;#;#, xrefs: 0041AE94
5, xrefs: 0041BDD4
; ;58<<, xrefs: 0041C4D3
t, xrefs: 0041BAF0
9, xrefs: 0041BE74
6, xrefs: 0041BE51
?, xrefs: 0041BDDB
gyi, xrefs: 0041CE2B
!, xrefs: 0041BCEE
1<!;"%!, xrefs: 0041C357
9, xrefs: 0041BF06
N, xrefs: 0041B08F
1, xrefs: 0041B050
0, xrefs: 0041B588
V, xrefs: 0041BB52
7, xrefs: 0041C580
8, xrefs: 0041BAF7
0, xrefs: 0041B59D
9, xrefs: 0041BD4A
T, xrefs: 0041B0C7
^, xrefs: 0041C1F0
1<!;"%!, xrefs: 0041B73B
0, xrefs: 0041C172
C, xrefs: 0041C1CD
b, xrefs: 0041B042
+, xrefs: 0041B5B2
6, xrefs: 0041BC64
:, xrefs: 0041BE66
https://www.maxmind.com/en/locate-my-ip-address, xrefs: 0041C0AD
:, xrefs: 0041B5C0
6, xrefs: 0041BE82
6, xrefs: 0041BE58
1: ,, xrefs: 0041BED6
y, xrefs: 0041B049
5, xrefs: 0041BCFC
9, xrefs: 0041BF1B
"%!, xrefs: 0041CCD4
v, xrefs: 0041B596
K, xrefs: 0041BB36
<290%, xrefs: 0041C713
6, xrefs: 0041BEFF
=, xrefs: 0041C732
#, xrefs: 0041B1A5
1, xrefs: 0041BCC4
<290%, xrefs: 0041C565
8, xrefs: 0041B58F
v, xrefs: 0041C7CE
6, xrefs: 0041C13A
), xrefs: 0041B057
:, xrefs: 0041BC79
<, xrefs: 0041BCCB
6, xrefs: 0041BC6B
7, xrefs: 0041C72E
6, xrefs: 0041BAE2
-, xrefs: 0041B081
;, xrefs: 0041B581
9, xrefs: 0041BC20
62 4, xrefs: 0041B847
7, xrefs: 0041BAE9
1: ,, xrefs: 0041BF7D
1<!;"%!, xrefs: 0041B7C6
1010;#;#, xrefs: 0041AEBE
1: ,, xrefs: 0041C6C8
1, xrefs: 0041BAB8
?, xrefs: 0041BD03
1: ,, xrefs: 0041B88B
62 4, xrefs: 0041B6E8
!, xrefs: 0041BDAA
1<!;"%!, xrefs: 0041C2F7
y, xrefs: 0041BAD4
:, xrefs: 0041BF0D
9, xrefs: 0041BD0A
<, xrefs: 0041BAC6
=, xrefs: 0041B57A

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: $!$!$!$!$"$"$"%!$#$#$#$#$#$$$%$%$%$%$&$)$+$-$0$0$0$0$1$1$1$1$1$1010;#;#$10;#;#$1: ,$1: ,$1: ,$1: ,$1: ,$1: ,$1: ,$1<!;$1<!;"%!$1<!;"%!$1<!;"%!$1<!;"%!$1<!;"%!$1<!;"%!$1<!;"%!$3$3$3$3$3#={;.1)t830q$4$4$5$5$5$5$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$62 4$62 4$62 4$62 4$62 4$7$7$7$8$8$8$8$8$9$9$9$9$9$9$9$9$9$9$9$9$9 6$:$:$:$:$:$:$;$;$;$;$;$;$;$;$; ;58<<$; ;58<<$; ;58<<$;#$;#;#$<$<$<$<290%$<290%$=$=$=$=$=$=$>$>$>$>$>$?$?$C$Content-Type: application/x-www-form-urlencoded$D$H$H$K$M$N$N$O$T$V$V$Z$[$]$^$b$c$c}e{$gyi$https://ipinfo.io/$https://www.maxmind.com/en/locate-my-ip-address$s$s$t$t$v$v$y$y$y${
API String ID: 667068680-2070094464
Opcode ID: 923cd99838d45b3046f962e919831202ff46d4e597a1e150e1b8529297517397
Instruction ID: bf9710a7a207a8ccf4af3cee12a165b4e35f870af137caed5c9356e2315dafa6
Opcode Fuzzy Hash: 923cd99838d45b3046f962e919831202ff46d4e597a1e150e1b8529297517397
Instruction Fuzzy Hash: EE134D30D08298D9EB22D768C9597DDBFB45F26308F4441DED0887B282D7B90F89DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0045EA9C Relevance: 200.4, APIs: 39, Strings: 74, Instructions: 2609threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000), ref: 0045EB04
GetLastError.KERNEL32 ref: 0045EB19
Sleep.KERNEL32(00000529), ref: 0045EB3A
Sleep.KERNEL32(0000002F), ref: 0045EBAA
shutdown.WS2_32(00000002), ref: 0045EBDA
closesocket.WS2_32 ref: 0045EBE6
WSACleanup.WS2_32 ref: 0045EBEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045ECA1
Sleep.KERNELBASE(00000065), ref: 0045EE48
Sleep.KERNEL32(00000000,?,?), ref: 0045EEFF
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 0045F20A
GetProcAddress.KERNEL32(00000000,00000000), ref: 0045F212
GetCurrentProcess.KERNEL32(00000000), ref: 0045F220
OutputDebugStringA.KERNELBASE(#@#^@#TGRERTERYERY,?,?,00000018,0000000A,Function_00002990,00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045F234
OutputDebugStringA.KERNELBASE(ewetwertyer eytdryrtdy,00000000,00000000), ref: 0045F2F5
OutputDebugStringA.KERNEL32(td ydrthrhfty,00000000), ref: 0045F4D0
OutputDebugStringA.KERNELBASE(45 hgfch rtdyt gfch,0051D9CA,?,?), ref: 0045FEA5
CreateThread.KERNELBASE(00000000,00000000,00450430,00000000,00000000,00000000), ref: 0045FED0
CreateThread.KERNELBASE(00000000,00000000,00455FC0,00000000,00000000,00000000), ref: 0045FEE6
WaitForSingleObject.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,0051DAE8,00000001,?,?), ref: 0046008D
CreateThread.KERNELBASE(00000000,00000000,Function_000564A0,00000000,00000000,00000000), ref: 00460280
CreateThread.KERNELBASE(00000000,00000000,Function_00058520,00000000,00000000,00000000), ref: 00460294
CreateThread.KERNELBASE(00000000,00000000,Function_0005A490,00000000,00000000,00000000), ref: 004602AB
CreateThread.KERNELBASE(00000000,00000000,Function_0005B4B0,00000000,00000000,00000000), ref: 004602C2
CreateThread.KERNELBASE(00000000,00000000,Function_0005CAE0,00000000,00000000,00000000), ref: 004602D9
CreateThread.KERNELBASE(00000000,00000000,Function_0005CC40,00000000,00000000,00000000), ref: 004602ED
CreateThread.KERNELBASE(00000000,00000000,Function_0005D7B0,00000000,00000000,00000000), ref: 00460301
WaitForSingleObject.KERNEL32(?,000493E0), ref: 004604BE
WaitForSingleObject.KERNEL32(?,000493E0), ref: 0046056B
OutputDebugStringA.KERNELBASE( drthdrthdrthdr hrtd hr,0051D9CA,?,?), ref: 00460FAA
CloseHandle.KERNEL32(?), ref: 004607EF

Part of subcall function 00462D20: Concurrency::cancel_current_task.LIBCPMT ref: 00463084

CreateMutexA.KERNEL32(00000000,00000001,00000000), ref: 004610D8
GetLastError.KERNEL32 ref: 004610ED
Sleep.KERNEL32(00007530), ref: 00461109
Sleep.KERNEL32(00000064), ref: 00461174
Sleep.KERNELBASE(00000BB8,?,?), ref: 004611A9
shutdown.WS2_32(00000002), ref: 004611B3
closesocket.WS2_32 ref: 004611BF
Sleep.KERNEL32(000003E8,?,?), ref: 004611D7

Strings

3+, xrefs: 0045F344
?(, xrefs: 0045F46E
<290, xrefs: 0045FBBE, 0045FBC6
5!57, xrefs: 0045F45A
4, xrefs: 00460E3C
5!57, xrefs: 0045F2FD
<290, xrefs: 0045F67B, 0045F683
45 hgfch rtdyt gfch, xrefs: 0045FEA0
$;+, xrefs: 0045F26F
$28 3, xrefs: 0045FC6E, 0045FC76
n1&k, xrefs: 0045F835, 0045F84C
|)=%, xrefs: 00460A63
drthdrthdrthdr hrtd hr, xrefs: 00460FA5
)/3/, xrefs: 0045F3D4
$28 3, xrefs: 0045F9CB, 0045F9D3
., xrefs: 0045ED09
95, xrefs: 0045F381
jjj, xrefs: 0045FEC1
?>2, xrefs: 0045F279
!?=6, xrefs: 0045EAB1
>00, xrefs: 0045F3CA
?>2, xrefs: 0045F2C3
!?=6, xrefs: 00461085
h0u, xrefs: 00461104
n1&k, xrefs: 0045FAD6, 0045FAEC
S2, xrefs: 0045F618
n1&k, xrefs: 0045FA44, 0045FA47
8$, xrefs: 0045FF19
:, xrefs: 004610A3
><3<, xrefs: 0045FF0F
' 1, xrefs: 0045F517
td ydrthrhfty, xrefs: 0045F4C6
0w, xrefs: 0045F63B
_Y, xrefs: 0045FA74
1,), xrefs: 0045F41A
_Y, xrefs: 0045FD13
:, xrefs: 0045EACF
_Y, xrefs: 0045F7D3
5!57, xrefs: 0045F3C0
><3<8$, xrefs: 0045FFC6, 0045FFCE
', xrefs: 0045F3DE
x345, xrefs: 0045EB54
wc, xrefs: 0045EF14
hHBT, xrefs: 00460FE2
[7, xrefs: 0045F240
$28 3, xrefs: 0045F728, 0045F730
jjj, xrefs: 0045FED2
5!57, xrefs: 0045F4D8
5!57, xrefs: 0045F33A
5!57, xrefs: 0045F2AF
$;+, xrefs: 0045F2B9
1, xrefs: 00460F6B
|)=%, xrefs: 00460B5E, 00460B6E
5!57, xrefs: 0045F377
n1&k, xrefs: 0045F79E, 0045F7A1
ewetwertyer eytdryrtdy, xrefs: 0045F2EB
3f, xrefs: 0045EE78
x345, xrefs: 0046111E
ntdll.dll, xrefs: 0045F203
094, xrefs: 0045F464
hXCT, xrefs: 00460FF8
>!6:, xrefs: 0045F521
<290, xrefs: 0045F91B, 0045F923
6>(., xrefs: 0045F38B
#?, xrefs: 0045F307
hhCT, xrefs: 00461024
5!57, xrefs: 0045F265
n1&k, xrefs: 0045FCE4, 0045FCE7
hxCT, xrefs: 0046100E
!(7, xrefs: 0045F4E2
#@#^@#TGRERTERYERY, xrefs: 0045F22F
5!57, xrefs: 0045F410
PnE, xrefs: 0046105C
n1&k, xrefs: 0045FD75, 0045FD8C

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Create$Thread$Sleep$DebugOutputString$ObjectSingleWait$ErrorHandleLastMutexclosesocketshutdown$AddressCleanupCloseConcurrency::cancel_current_taskCurrentModuleProcProcessUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: 95$!(7$#?$$;+$$;+$094$1,)$3+$>00$ drthdrthdrthdr hrtd hr$!?=6$!?=6$#@#^@#TGRERTERYERY$$28 3$$28 3$$28 3$'$' 1$)/3/$.$1$4$45 hgfch rtdyt gfch$5!57$5!57$5!57$5!57$5!57$5!57$5!57$5!57$5!57$6>(.$8$$:$:$<290$<290$<290$>!6:$><3<$><3<8$$?($?>2$?>2$PnE$_Y$_Y$_Y$ewetwertyer eytdryrtdy$h0u$hHBT$hXCT$hhCT$hxCT$jjj$jjj$n1&k$n1&k$n1&k$n1&k$n1&k$n1&k$ntdll.dll$td ydrthrhfty$x345$x345$|)=%$|)=%$0w$3f$S2$[7$wc
API String ID: 2410146291-3778327771
Opcode ID: 77b46a48ab44eab4bccd9757b55f6f36dd584b1fd56f99d5612ab793db1a330f
Instruction ID: b7f19cb37b0b56de54bd6a9fc88ff5451383e5df5d0154206795b38d17b259f9
Opcode Fuzzy Hash: 77b46a48ab44eab4bccd9757b55f6f36dd584b1fd56f99d5612ab793db1a330f
Instruction Fuzzy Hash: E943CF30900258DBCB25DF68C895BEEBBB0AF15308F1441DAD4456B392EB74AF49CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00446020 Relevance: 139.6, APIs: 13, Strings: 65, Instructions: 3085registryfilecomCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004485E3
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000,?,?), ref: 004486E2
RegCloseKey.ADVAPI32(?,?,?), ref: 0044870C
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00448973
GetUserNameA.ADVAPI32(?,00000104), ref: 004489A9

Part of subcall function 004160B0: GetModuleHandleA.KERNEL32(3B263619,?), ref: 00416186
Part of subcall function 004160B0: GetProcAddress.KERNEL32(00000000,34312111), ref: 00416191
Part of subcall function 004160B0: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004161E1

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020006), ref: 0044865A

Part of subcall function 00415E30: GetFileAttributesA.KERNELBASE(?,7FFFFFFF), ref: 00415EDC

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004490D9
SHGetFolderPathA.SHELL32(00000000,00000007,00000000,00000000,?), ref: 004490F6
CoInitialize.OLE32(00000000), ref: 004491DD
CoCreateInstance.OLE32(Function_00115570,00000000,00000001,Function_00115540,?), ref: 004491FD
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 00449289
CoUninitialize.OLE32 ref: 004492B9
ShellExecuteA.SHELL32(00000000,=#1;,00000000,00000000,00000000,00000001), ref: 00449327

Strings

|6,0, xrefs: 00448506
6<94?9, xrefs: 00446FF9, 00447001
|6,0, xrefs: 00449000
|, xrefs: 0044701A
'!8, xrefs: 004472A6
&+ , xrefs: 00447C3C
8#12, xrefs: 00447DB3
38, xrefs: 004461ED
, xrefs: 0044941F
r, xrefs: 004464B8
?), xrefs: 004483AA
?2&>47,4/.4;,, xrefs: 00446921, 00446927
?2&>374;22., xrefs: 00446842, 00446848
"=3, xrefs: 00447D1C
7%3*, xrefs: 0044615F
|, xrefs: 00447A71
&39-, xrefs: 004483A0
|, xrefs: 00446CAA
'!8, xrefs: 0044727A
~, xrefs: 00446869
$;, xrefs: 00446226
|, xrefs: 0044809E
|6,0, xrefs: 00448896
7+1, xrefs: 00447B32
ps{!, xrefs: 00448A43
7:=, xrefs: 0044611F
".?9, xrefs: 00448C2A
'!8, xrefs: 004477DE
H, xrefs: 00448CEE
F/!., xrefs: 00448C20
ps{!, xrefs: 00448C98
ps{!, xrefs: 00448A1A
'!8, xrefs: 004474E3
~, xrefs: 004462F2
? =, xrefs: 00447BA8
~, xrefs: 004465B0
I5=I, xrefs: 00448CE7
!0&, xrefs: 00447BF2
$wz, xrefs: 00448CA2
'!8, xrefs: 004474BA
6<94?9, xrefs: 00446C89, 00446C91
8#3, xrefs: 00447D66
6<7-, xrefs: 00447CD0
r, xrefs: 00446574
:' %%mwv, xrefs: 0044822D, 00448233
6<94?9, xrefs: 00446FC7, 00446FCF
ps{!, xrefs: 00448C6C
$wz, xrefs: 00448A4D
4:18, xrefs: 004461AB
~, xrefs: 00446955
#>4=, xrefs: 004461A1
=#1;, xrefs: 0044931E, 00449324
6<7, xrefs: 00447C86
$1', xrefs: 00447E98
|?:>, xrefs: 00449120
0>$, xrefs: 00447E02
7+1, xrefs: 00448079
;/9/, xrefs: 00448318
|6,0, xrefs: 00447A4B, 00447A5D
'!8, xrefs: 0044780A
6<94?9, xrefs: 00446C57, 00446C5F
8wz, xrefs: 00448A24
8wz, xrefs: 00448C76
~, xrefs: 00446685
02 , xrefs: 00447E4F

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$Copy$AttributesCreate$AddressByteCharCloseErrorExecuteFolderHandleInitializeInstanceLastModuleMultiNameOpenPathProcProcessShellUninitializeUserValueWide
String ID: $!0&$".?9$"=3$#>4=$$1'$$;$$wz$$wz$&+ $&39-$'!8$'!8$'!8$'!8$'!8$'!8$02 $0>$$38$4:18$6<7$6<7-$6<94?9$6<94?9$6<94?9$6<94?9$7%3*$7+1$7+1$7:=$8#12$8#3$8wz$8wz$:' %%mwv$;/9/$=#1;$? =$?)$?2&>374;22.$?2&>47,4/.4;,$F/!.$H$I5=I$ps{!$ps{!$ps{!$ps{!$r$r$|$|$|$|$|6,0$|6,0$|6,0$|6,0$|?:>$~$~$~$~$~
API String ID: 28878968-3024362790
Opcode ID: e9beca0d44d6b3e0f7067b99af4fd5410984dd6de7413f022354d57091ea6fdf
Instruction ID: 429461b7d5384cafcc2df35996eafbcc51918cc99cf467c7d99fa79c194b986d
Opcode Fuzzy Hash: e9beca0d44d6b3e0f7067b99af4fd5410984dd6de7413f022354d57091ea6fdf
Instruction Fuzzy Hash: C863AA70D042989ADB25EB64CD55BDEBBB4AF11308F0041DAE449772D2EB781F88CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD50 Relevance: 110.0, APIs: 43, Strings: 19, Instructions: 1490
registrytimeprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AF30: GetCurrentProcess.KERNEL32(00000000,?,?,0040C4BE), ref: 0040AF3F
Part of subcall function 0040AF30: IsWow64Process.KERNEL32(00000000,?,0040C4BE), ref: 0040AF46

Part of subcall function 004EAB9B: GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000000,00000000,?,00403276,00000000,0045DC3C,00000000), ref: 004EABB0
Part of subcall function 004EAB9B: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004EABCF

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,3B3F3D07,00000000), ref: 0040CF74
RegQueryValueExA.KERNELBASE(00000000,3D37321F,00000000,00020019,?,00000400), ref: 0040CFCC
RegCloseKey.ADVAPI32(00000000), ref: 0040D002
GetCurrentHwProfileA.ADVAPI32(?), ref: 0040D0A7
GetModuleHandleExA.KERNEL32(00000004,Function_0000BD20,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0040D3A8
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,00000000,00000000), ref: 0040D3BD
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,3B3F3D07,00000000), ref: 0040D65A
RegQueryValueExA.KERNELBASE(00000000,313B2102,00000000,00020019,?,00000400), ref: 0040D6B2
RegCloseKey.ADVAPI32(00000000), ref: 0040D721
GetComputerNameA.KERNEL32(?,00000104), ref: 0040D755
GetUserNameA.ADVAPI32(?,00000104), ref: 0040D80F
GetDesktopWindow.USER32 ref: 0040D840
GetWindowRect.USER32(00000000,?), ref: 0040D84E
GetUserDefaultLocaleName.KERNEL32(?,00000200), ref: 0040D8CD
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040D9CA
LocalAlloc.KERNEL32(00000040), ref: 0040D9D9
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040D9EE
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040DA16
LocalFree.KERNEL32(3B3F3D07), ref: 0040DA8B
GetLocalTime.KERNEL32(?), ref: 0040DAA2
GetSystemTime.KERNEL32(?), ref: 0040DB30
GetTimeZoneInformation.KERNELBASE(?), ref: 0040DB53
TzSpecificLocalTimeToSystemTime.KERNELBASE(?,?,?), ref: 0040DB78
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,00000000), ref: 0040DC84
RegQueryValueExA.KERNELBASE(00000000,?,00000000,00020019,?,00000400), ref: 0040DCD9
RegCloseKey.ADVAPI32(00000000), ref: 0040DD14
GetSystemInfo.KERNELBASE(?), ref: 0040DD3C
GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 0040DD7D
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 0040DE21
EnumDisplayDevicesA.USER32(00000000,00000001,?,00000001), ref: 0040DFF9
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040E04C
Process32First.KERNEL32(00000000,00000128), ref: 0040E064
Process32Next.KERNEL32(00000000,00000128), ref: 0040E076
Process32Next.KERNEL32(00000000,?), ref: 0040E0C2
CloseHandle.KERNEL32(00000000), ref: 0040E0CD
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 0040E181
RegEnumKeyExA.KERNELBASE(00000000,00000000,?,01002077,00000000,00000000,00000000,00000000), ref: 0040E1B2
wsprintfA.USER32 ref: 0040E1F8
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,01002077), ref: 0040E218
RegQueryValueExA.KERNELBASE(01002077,25273A16,00000000,000F003F,?,00000400), ref: 0040E26D
RegQueryValueExA.KERNELBASE(01002077,25273A16,00000000,000F003F,?,00000400), ref: 0040E2B7
RegCloseKey.ADVAPI32(01002077), ref: 0040E2FF
RegCloseKey.ADVAPI32(00000000), ref: 0040E317

Strings

?, xrefs: 0040E229
*`f, xrefs: 0040D6DB, 0040D706
;69, xrefs: 0040E245
%1, xrefs: 0040E416
P, xrefs: 0040E2D2
?)/4, xrefs: 0040E28C
b, xrefs: 0040E4EA
@, xrefs: 0040DD6C
"O, xrefs: 0040DC5B
lw}*, xrefs: 0040D359
;)9, xrefs: 0040E0E4
2mx|, xrefs: 0040CE32
@, xrefs: 0040D1C5
%1, xrefs: 0040CDC9
^E, xrefs: 0040D868
r|tps$US9 6, xrefs: 0040DA5B, 0040DA5E
91,., xrefs: 0040E0DD
;69, xrefs: 0040D687
11, xrefs: 0040E293

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Time$Close$OpenQueryValue$LocalNameSystem$EnumProcess32$CurrentDevicesDisplayFileHandleInfoKeyboardLayoutListLocaleModuleNextProcessUserWindow$AllocComputerCreateDefaultDesktopFirstFreeGlobalInformationMemoryProfileRectSnapshotSpecificStatusToolhelp32Unothrow_t@std@@@Wow64Zone__ehfuncinfo$??2@wsprintf
String ID: ^E$"O$%1$%1$*`f$11$2mx|$91,.$;)9$;69$;69$?$?)/4$@$@$P$b$lw}*$r|tps$US9 6
API String ID: 3690012277-3366278946
Opcode ID: edaf7777c747bf334e1ba9b5ac52c2c07ead8a52947743ebef3e72c5c92dc61f
Instruction ID: 7bd027b0dfb8d2919de4826a5c8300a61b342aa26dd66dfc15b9c1e4c8c75cd4
Opcode Fuzzy Hash: edaf7777c747bf334e1ba9b5ac52c2c07ead8a52947743ebef3e72c5c92dc61f
Instruction Fuzzy Hash: 53E28E71C0025DDADB11DBA0CC45BEEB7B8BF15308F00419AE549B7292EBB81B89CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00434B20 Relevance: 109.6, APIs: 6, Strings: 55, Instructions: 2842stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00434C41
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00434CE6
GetPrivateProfileStringA.KERNEL32(?,3D203202,00000000,?,00000104,?), ref: 00434DB6
lstrlenA.KERNEL32(?), ref: 00437778

Part of subcall function 0040AB40: __fread_nolock.LIBCMT ref: 0040AC3C

CreateDirectoryA.KERNEL32(?,00000000,?,3421020E,?,00000000,3421020E,3421020F,?,?,><3<8$,><3<8$,00000000), ref: 00436806
CreateDirectoryA.KERNEL32(?,00000000), ref: 00436B77

Strings

"ov=, xrefs: 00437309
%1, xrefs: 00436BF4
by<;, xrefs: 00436ECE
16&!ny<;, xrefs: 004372C7, 004372F0
"ov=, xrefs: 0043719E
8#-4, xrefs: 00436744
8, xrefs: 00437488
'!8, xrefs: 00435FDC, 0043600C
:<'!865<, xrefs: 00436104, 00436111
4<&8, xrefs: 00435E81
><3<8$, xrefs: 00435958, 0043595E
'!8, xrefs: 00436155, 00436182
><3<8$, xrefs: 00435B41, 00435B4E
3, xrefs: 00437814
"nv=, xrefs: 0043747E
1, xrefs: 00434EA5
ey<;, xrefs: 00436B91
?9+w, xrefs: 00434E61
%1, xrefs: 00437170
\, xrefs: 00434DBC
ey<;, xrefs: 00436D65
%1, xrefs: 00437450
%1, xrefs: 00436EA2
96-fx3:, xrefs: 00436D24, 00436D4C
"nv=, xrefs: 004375E8
ey<;, xrefs: 00436C1E
8, xrefs: 00437106
?;=, xrefs: 00434D0C
><3<8$, xrefs: 00436696, 0043669C
\, xrefs: 0043694E
8, xrefs: 004371A8
0>4<, xrefs: 00434C6C
4<&8, xrefs: 00435F47
><3<8, xrefs: 004356B7, 004356E4
96-ax3:, xrefs: 00436FE6, 0043700F
16&!oy<;, xrefs: 004375A6, 004375CF
"2'&!8*=, xrefs: 0043654B, 0043657F
*,, xrefs: 00436758
><3<8$, xrefs: 00434BBE, 00434BC5
_, xrefs: 0043693E
4<&8, xrefs: 00435EE4
"!;3?;=, xrefs: 00435421, 00435454
8, xrefs: 00437313
cannot use operator[] with a string argument with , xrefs: 00437803, 0043785D
"!;3?;=, xrefs: 00435D92, 00435DBF
'!8, xrefs: 00435565, 00435592
><3<8$, xrefs: 00435B91, 00435B9E
by<;, xrefs: 00436E3F
8, xrefs: 004373EC
8, xrefs: 004375F2
by<;, xrefs: 00437028
"ov=, xrefs: 004370FC
"2'&!8*=, xrefs: 0043581B, 0043584F
"nv=, xrefs: 004373E2
0(33, xrefs: 00434E68

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateDirectoryPrivateProfile$FolderNamesPathSectionString__fread_nolocklstrlen
String ID: 1$"!;3?;=$"!;3?;=$"2'&!8*=$"2'&!8*=$"nv=$"nv=$"nv=$"ov=$"ov=$"ov=$%1$%1$%1$%1$'!8$'!8$'!8$*,$0(33$0>4<$16&!ny<;$16&!oy<;$3$4<&8$4<&8$4<&8$8$8$8$8$8$8$8#-4$96-ax3:$96-fx3:$:<'!865<$><3<8$><3<8$$><3<8$$><3<8$$><3<8$$><3<8$$?9+w$?;=$\$\$_$by<;$by<;$by<;$cannot use operator[] with a string argument with $ey<;$ey<;$ey<;
API String ID: 2628882823-1854249681
Opcode ID: a5ba68485a38c1d7dc27bf28a2e010da92d7f83882af55282c1ec9672914cbca
Instruction ID: a36599697f4023ba1647c38f0aef950e154c638e9f7ae6bdb9cf337964260f01
Opcode Fuzzy Hash: a5ba68485a38c1d7dc27bf28a2e010da92d7f83882af55282c1ec9672914cbca
Instruction Fuzzy Hash: 0F53CF70C042989EDF25DB64CC48BEEBBB4AF16308F1441DED44967282EB785B89CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00458520 Relevance: 106.7, APIs: 3, Strings: 57, Instructions: 1711COMMON

Download Yara Rule

APIs

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

Part of subcall function 0040B270: CreateDirectoryA.KERNELBASE(?,00000000,00000005,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B2B5

Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B24F
Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B260

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00459B2F
CreateDirectoryA.KERNEL32(?,00000000,00000000,?), ref: 00459CDC
CreateDirectoryA.KERNEL32(?,00000000,00000000,?), ref: 00459DA2

Strings

&<?08, xrefs: 0045A0A6
$6,0, xrefs: 00458C69
$28 3, xrefs: 0045977D
*:, xrefs: 004596BA
t/$), xrefs: 004588FD
31, xrefs: 00458A8E
!67 $2, xrefs: 00459811
7+$<, xrefs: 00458CAC
$6,0, xrefs: 00458CB6
=>=*, xrefs: 004588F3
$6,0, xrefs: 00459659
$6,0, xrefs: 004596A6
|',!, xrefs: 00459358
<290, xrefs: 00458D54
<290, xrefs: 00458D24
31, xrefs: 00459F5B
<290, xrefs: 00459714
!$=+, xrefs: 00459AA8
&<?08, xrefs: 0045A080
7+$<, xrefs: 0045969C
|',!, xrefs: 00458949
!6&#, xrefs: 0045A002
*:, xrefs: 0045966D
7+$<, xrefs: 00458C5F
"2 =, xrefs: 00458C10
6<94?9, xrefs: 00459590
"2 =, xrefs: 00458C40
31, xrefs: 00459484
:' %, xrefs: 0045988F
?4=, xrefs: 0045A00C
=>=*, xrefs: 00459302
$28 3, xrefs: 004597AF
<290, xrefs: 00459744
!$=+, xrefs: 0045861C
7+$<, xrefs: 0045964F
"2 =, xrefs: 00459630
), xrefs: 00459AAF
*:, xrefs: 00458CCA
|',!, xrefs: 00459E16
=>=*, xrefs: 004585ED
%1, xrefs: 0045A23F
6<94?9, xrefs: 00458BA0
w Y_, xrefs: 0045A306
$28 3, xrefs: 00458DBF
6<94?96<94?9, xrefs: 004595C9
!67 $2, xrefs: 00458E2D
?4=, xrefs: 0045A03F
"2 =, xrefs: 00459600
w ]p, xrefs: 0045A0FC
", xrefs: 0045A333
!6&#, xrefs: 0045A035
:' %, xrefs: 00458EAE
*:, xrefs: 00458C7D
t/$), xrefs: 0045930C
$28 3, xrefs: 00458D8D
), xrefs: 00458626
6<94?96<94?9, xrefs: 00458BD9

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID: !$=+$!$=+$!6&#$!6&#$!67 $2$!67 $2$"$"2 =$"2 =$"2 =$"2 =$$28 3$$28 3$$28 3$$28 3$$6,0$$6,0$$6,0$$6,0$%1$&<?08$&<?08$)$)$*:$*:$*:$*:$31$31$31$6<94?9$6<94?9$6<94?96<94?9$6<94?96<94?9$7+$<$7+$<$7+$<$7+$<$:' %$:' %$<290$<290$<290$<290$=>=*$=>=*$=>=*$?4=$?4=$t/$)$t/$)$w Y_$w ]p$|',!$|',!$|',!
API String ID: 453214671-2294095452
Opcode ID: 7ffdaf4037cb2d030a63199d217c015197ae860a8e502b6e60a93467012496ea
Instruction ID: 57ae14f2feaf59c3a95a653b4d20b0d10ef2dfc7cc1885f066834b7badb08a9e
Opcode Fuzzy Hash: 7ffdaf4037cb2d030a63199d217c015197ae860a8e502b6e60a93467012496ea
Instruction Fuzzy Hash: 70036B70904298DEDB25EB65C9597DEBBB4AF11308F0400DED44977292EBB81F88CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00428180 Relevance: 94.4, APIs: 2, Strings: 50, Instructions: 3351COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,3E3B3C31), ref: 004282B4

Part of subcall function 0040AB40: __fread_nolock.LIBCMT ref: 0040AC3C

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042A957

Part of subcall function 004DE42B: RaiseException.KERNEL32(E06D7363,00000001,00000003,0045DCD0,0045DCD0,?,?,004DAF37,0045DCD0,0053D744,00000000,0045DCD0,00000000,00000001), ref: 004DE48B

Strings

9%3, xrefs: 0042845C
$bd, xrefs: 0042AD2E
$.(-, xrefs: 0042969F
/',<, xrefs: 00428C8D
[, xrefs: 0042B641
!67 $2, xrefs: 0042A71F, 0042A74F
', xrefs: 00428D4D
<290, xrefs: 0042AC31, 0042AC3E
$.(-, xrefs: 0042974B
\, xrefs: 00429428
1, xrefs: 0042A4D9
6<94?9, xrefs: 0042A031, 0042A03E
$6,0, xrefs: 0042A999
!8*2, xrefs: 004284D3
7=7', xrefs: 00428D2D
', xrefs: 004296FE
\, xrefs: 00428EF4
\, xrefs: 00428AAD
\, xrefs: 00429BAE
\, xrefs: 004291F6
\, xrefs: 00428515
\, xrefs: 0042892A
\, xrefs: 00429C2D
7=7', xrefs: 00428C83
$.(-, xrefs: 00428C02
1, xrefs: 0042A099
$28 3, xrefs: 0042AED9, 0042AEFC
$be, xrefs: 0042AD63
/',<, xrefs: 004296E8
"2 =, xrefs: 0042A471, 0042A47E
\, xrefs: 004293AC
', xrefs: 004297AC
/',<, xrefs: 00428D37
\, xrefs: 00428F6A
1<;>?2+, xrefs: 00428221
/',<, xrefs: 00429796
cannot use operator[] with a string argument with , xrefs: 0042B53A, 0042B58C, 0042B5DE, 0042B630
?2+, xrefs: 0042B3F0
7+$<, xrefs: 0042A98F
$28 3, xrefs: 0042B135, 0042B15C
$.(-, xrefs: 00429646
', xrefs: 00428CA3
7=7', xrefs: 0042978C
7=7', xrefs: 004296DE
#;,, xrefs: 0042B262
:' %, xrefs: 0042A264
1<;>, xrefs: 0042B3E7
$.(-, xrefs: 00428CEE
*:, xrefs: 0042A9AD
#;,, xrefs: 004299A8

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFolderPathRaiseUnothrow_t@std@@@__ehfuncinfo$??2@__fread_nolock
String ID: !67 $2$!8*2$"2 =$#;,$#;,$$.(-$$.(-$$.(-$$.(-$$.(-$$28 3$$28 3$$6,0$$bd$$be$'$'$'$'$*:$/',<$/',<$/',<$/',<$1$1$1<;>$1<;>?2+$6<94?9$7+$<$7=7'$7=7'$7=7'$7=7'$9%3$:' %$<290$?2+$[$\$\$\$\$\$\$\$\$\$\$cannot use operator[] with a string argument with
API String ID: 763711979-1342090246
Opcode ID: d4924dc1aa83f635cd173e36e8337de148a2d92050d0f285119bc9b0dc1bf2fd
Instruction ID: 75da0da8fc7ec44c57da9840ff1f0e32adef3685c6fae34395cd54ce1a610f13
Opcode Fuzzy Hash: d4924dc1aa83f635cd173e36e8337de148a2d92050d0f285119bc9b0dc1bf2fd
Instruction Fuzzy Hash: 1A73CD70D002A88BDB25DB68DC547EEBBB0AF15308F5441DED44967282DB786F88CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004564A0 Relevance: 90.6, Strings: 71, Instructions: 1823COMMON

Download Yara Rule

Strings

;615, xrefs: 00458266
><3<8, xrefs: 00456FEC
"!;3, xrefs: 004570D1
?;=, xrefs: 004570A2
%1, xrefs: 00457314
?;=, xrefs: 00457974
'!8, xrefs: 00456666
>(r), xrefs: 004572A8
"!;3, xrefs: 004579A3
&+, xrefs: 0045760A
"2'&!8*=, xrefs: 00456798
), xrefs: 00456516
w w , xrefs: 00458332
u, xrefs: 00456949
?;=, xrefs: 004567C7
%1, xrefs: 004575DF
"2'&!8*=, xrefs: 00457033
?;=, xrefs: 00457E15
"!;3, xrefs: 0045796A
"2'&!8*=, xrefs: 00457DA6
`a, xrefs: 004583AA
"!;3, xrefs: 00457098
58*=, xrefs: 00458057
'!8, xrefs: 00457CE6
?;=*, xrefs: 0045693F
><3<8, xrefs: 00456711
"!;3, xrefs: 00457E44
%1, xrefs: 00458037
>(r), xrefs: 00457603
w %1, xrefs: 00457360
'!8, xrefs: 00457CB7
w , xrefs: 00458306
"2'&!8*=, xrefs: 00457905
i, xrefs: 00457B3D
% 7+, xrefs: 004572A1
t/$), xrefs: 00458270
t/$), xrefs: 00458061
'!8, xrefs: 00456F35
w %1, xrefs: 00456B8F
?;=, xrefs: 00456800
><3<8, xrefs: 00457D36
'!8, xrefs: 00457807
"2'&!8*=, xrefs: 00456758
>(r), xrefs: 00456AC2
%1w , xrefs: 00458254
'!8, xrefs: 00456689
&+, xrefs: 00456ACC
'!8, xrefs: 00456F64
w , xrefs: 00457690
?;=, xrefs: 004579AD
><3<8, xrefs: 00456FB4
"!;3, xrefs: 00457E0B
31, xrefs: 00456BA7
><3<8, xrefs: 004578BE
"!;3, xrefs: 004567BD
"2'&!8*=, xrefs: 00457073
% 7+, xrefs: 00456AB8
&+, xrefs: 004572AF
31, xrefs: 00457378
?;=, xrefs: 004570DB
"2'&!8*=, xrefs: 00457DE6
'!8, xrefs: 00457836
><3<8, xrefs: 00457886
><3<8, xrefs: 00457D65
!$=+, xrefs: 0045650C
% 7+, xrefs: 004575FC
"!;3, xrefs: 004567F6
?;=, xrefs: 00457E4E
%1, xrefs: 00456B3B
><3<8, xrefs: 004566D9
"2'&!8*=, xrefs: 00457945

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$AttributesCreateDirectoryErrorFileLast
String ID: !$=+$"!;3$"!;3$"!;3$"!;3$"!;3$"!;3$"!;3$"!;3$"2'&!8*=$"2'&!8*=$"2'&!8*=$"2'&!8*=$"2'&!8*=$"2'&!8*=$"2'&!8*=$"2'&!8*=$% 7+$% 7+$% 7+$%1$%1$%1$%1$%1w $&+$&+$&+$'!8$'!8$'!8$'!8$'!8$'!8$'!8$'!8$)$31$31$58*=$;615$>(r)$>(r)$>(r)$><3<8$><3<8$><3<8$><3<8$><3<8$><3<8$><3<8$><3<8$?;=$?;=$?;=$?;=$?;=$?;=$?;=$?;=$?;=*$`a$i$t/$)$t/$)$u$w $w $w %1$w %1$w w
API String ID: 325604351-255260331
Opcode ID: e556535a9cc80b20ff5b8f10c0fe63d3abeddd39d78d0eecea6124594b8e99d3
Instruction ID: b3a347ab2d5913c55b79dc2b7675eac22e4de48785ab9d64140a0416f3fdeda6
Opcode Fuzzy Hash: e556535a9cc80b20ff5b8f10c0fe63d3abeddd39d78d0eecea6124594b8e99d3
Instruction Fuzzy Hash: FB137B30C04298DADB21EBA5CD557DDBBB4AF21308F4441EED44977292EBB81F88CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0044C160 Relevance: 70.2, Strings: 54, Instructions: 2710COMMON

Download Yara Rule

Strings

3, xrefs: 0044C959
8>3, xrefs: 0044E5EF
*/>, xrefs: 0044C389
,&, xrefs: 0044C28A
7:, xrefs: 0044CF94
;8<6, xrefs: 0044E973
/(, xrefs: 0044D29B
}, xrefs: 0044D4AF
7, xrefs: 0044C6AD
58*=, xrefs: 0044C274
:2v7, xrefs: 0044CB3F
,, xrefs: 0044EB43
""5, xrefs: 0044DF76
', xrefs: 0044C303
9, xrefs: 0044D0C9
;5=/, xrefs: 0044C2F9
?/, xrefs: 0044CB49
e, xrefs: 0044D373
8, xrefs: 0044CA51
?8, xrefs: 0044DBE5
9:2<, xrefs: 0044C280
9%<, xrefs: 0044C1FF
)>., xrefs: 0044D45F
;, xrefs: 0044D9EA
>:1778, xrefs: 0044DDD7, 0044DDEF
:31, xrefs: 0044D61F
$85<, xrefs: 0044E6D4
;2xq, xrefs: 0044CD3F
?), xrefs: 0044E329
94, xrefs: 0044E7CA
5,/8, xrefs: 0044EB39
9#, xrefs: 0044D543
58*=, xrefs: 0044C192
$8/*, xrefs: 0044E31F
;2, xrefs: 0044C790
$, xrefs: 0044D37A
9%<, xrefs: 0044C3F2
;, xrefs: 0044CFEA
28, xrefs: 0044E21F
3/, xrefs: 0044CE2E
>86j, xrefs: 0044E40F
"cjt, xrefs: 0044CD49
;>-4, xrefs: 0044DAEF
4>(, xrefs: 0044CAD1
:86, xrefs: 0044E4F6
;>-4, xrefs: 0044CC2F
;-, xrefs: 0044DB03
99, xrefs: 0044E06F
99, xrefs: 0044DCCF
?"5, xrefs: 0044D19F
";=w, xrefs: 0044CAC5
"6, xrefs: 0044D703
58*=, xrefs: 0044C379
>, xrefs: 0044E13F

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ""5$"6$";=w$"cjt$$$$8/*$$85<$'$)>.$*/>$,$,&$/($28$3$3/$4>($5,/8$58*=$58*=$58*=$7$7:$8$8>3$9$9#$9%<$9%<$94$99$99$9:2<$:2v7$:31$:86$;$;$;-$;2$;2xq$;5=/$;8<6$;>-4$;>-4$>$>86j$>:1778$?"5$?)$?/$?8$e$}
API String ID: 0-1917627054
Opcode ID: a3c8e956da570ee25101835e7003ff49c9b78fbf518cf9b4dba23278fd7aedad
Instruction ID: da39ab965d1940bc429dee9ee324b5140dc3135ed84ad1a1ee1fae0531cfa133
Opcode Fuzzy Hash: a3c8e956da570ee25101835e7003ff49c9b78fbf518cf9b4dba23278fd7aedad
Instruction Fuzzy Hash: 6343A0B0C006699ADF15DF68C9156EEBBB4AF15308F0442CED45437282DBB91B8ACFD6

Uniqueness

Uniqueness Score: -1.00%

Function 0045E5D4 Relevance: 60.0, APIs: 16, Strings: 18, Instructions: 450
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,0041E220,00000000,00000000,00000000), ref: 0045E684
FindCloseChangeNotification.KERNELBASE(00000000), ref: 0045E68B
Sleep.KERNELBASE(00000001), ref: 0045E738
GetTempPathA.KERNEL32(000000FB,?,00000000), ref: 0045E78E

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

CreateDirectoryA.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000), ref: 0045E927
CreateDirectoryA.KERNELBASE(00000000,00000000,?,00000000), ref: 0045E953
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045E96A

Strings

37;7, xrefs: 0045E7AE
>i, xrefs: 0045E94D
jjj, xrefs: 0045E675
?, xrefs: 0045E856
!?=6, xrefs: 00461085
h0u, xrefs: 00461104
x345, xrefs: 0046111E
hXCT, xrefs: 00460FF8
hHBT, xrefs: 00460FE2
:, xrefs: 004610A3
drthdrthdrthdr hrtd hr, xrefs: 00460FA5
h, xrefs: 0045E5D7
hhCT, xrefs: 00461024
hxCT, xrefs: 0046100E
:6=1, xrefs: 0045E84C
3, xrefs: 0045E7B8
PnE, xrefs: 0046105C
pi, xrefs: 0045E91B

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Create$Directory$AttributesChangeCloseErrorFileFindLastNotificationPathSleepTempThreadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: drthdrthdrthdr hrtd hr$!?=6$3$37;7$:$:6=1$?$PnE$h$h0u$hHBT$hXCT$hhCT$hxCT$jjj$x345$>i$pi
API String ID: 2868636072-2239746989
Opcode ID: 060185c10945b35e633fe78b632396f90ace800327952daae0b24959247380db
Instruction ID: 8077588bf94c0e4bc39e93033f8a776c4edc121c9ce1f6a3b1a7cfd8669552db
Opcode Fuzzy Hash: 060185c10945b35e633fe78b632396f90ace800327952daae0b24959247380db
Instruction Fuzzy Hash: D3121470A002488BCB18EF69CC55BDEBB71AF55308F1441DEE9056B2D2EB745F48CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0042C980 Relevance: 59.9, APIs: 1, Strings: 32, Instructions: 2164COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,3E3B2735,?,?,?,00000004), ref: 0042CAB4

Strings

!6&#, xrefs: 0042E435
/',<, xrefs: 0042DD18
&<?08\, xrefs: 0042E742, 0042E76F
$.(-, xrefs: 0042DD7B
39+, xrefs: 0042E964
/',<, xrefs: 0042DDC6
\, xrefs: 0042D24A
\, xrefs: 0042D68B
7=7', xrefs: 0042DDBC
$be, xrefs: 0042E5AC
\, xrefs: 0042E0A2
$.(-, xrefs: 0042DC7C
/',<, xrefs: 0042D48A
5';>39+, xrefs: 0042E704
\, xrefs: 0042D8E4
7=7', xrefs: 0042D483
?4=, xrefs: 0042E43F
cannot use operator[] with a string argument with , xrefs: 0042EB50
', xrefs: 0042D49A
', xrefs: 0042DDDC
\, xrefs: 0042CC34
V, xrefs: 0042EB61
$.(-, xrefs: 0042DCCF
\, xrefs: 0042E0D2
\, xrefs: 0042D0D0
$bd, xrefs: 0042E569
', xrefs: 0042DD2E
\, xrefs: 0042DA7A
7=7', xrefs: 0042DD0E
\, xrefs: 0042D657
\, xrefs: 0042DAB1
5';>, xrefs: 0042E95B

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: !6&#$$.(-$$.(-$$.(-$$bd$$be$&<?08\$'$'$'$/',<$/',<$/',<$39+$5';>$5';>39+$7=7'$7=7'$7=7'$?4=$V$\$\$\$\$\$\$\$\$\$\$cannot use operator[] with a string argument with
API String ID: 1514166925-3834567515
Opcode ID: f6d095819e170645b5d619eb65eb2d2f37c51cdae5ce08f972e7f4a27304ea9d
Instruction ID: 533f620bba5b2773b9cbc6b6bd3ac26e45f2e0f23bfd5e739c1d7210883c523b
Opcode Fuzzy Hash: f6d095819e170645b5d619eb65eb2d2f37c51cdae5ce08f972e7f4a27304ea9d
Instruction Fuzzy Hash: EB23CF70D002A88BDF25DB68CD547EEBBB0AF15304F1442DEE44967282DBB85B89CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0045B4B0 Relevance: 46.2, Strings: 36, Instructions: 1224COMMON

Download Yara Rule

Strings

9:.9, xrefs: 0045C240
, xrefs: 0045C874
7+$;86-2, xrefs: 0045C56A
w ]p:;-TP, xrefs: 0045BB25
<290, xrefs: 0045C22C
), xrefs: 0045B506
&:90, xrefs: 0045BA92
|',!, xrefs: 0045BF8D
"/,, xrefs: 0045BF51
), xrefs: 0045BC39
12&1, xrefs: 0045C2AF
8>., xrefs: 0045C2C3
7+$/29+, xrefs: 0045C621
%1, xrefs: 0045B98A
"8* , xrefs: 0045B52A
<:7>865<, xrefs: 0045C1D3
<:7>865<, xrefs: 0045C20D
|',!, xrefs: 0045B85E
12&1, xrefs: 0045C2EC
"8* , xrefs: 0045B808
9:.9, xrefs: 0045C281
t/$), xrefs: 0045B812
>2'!17,(, xrefs: 0045C359
'!8, xrefs: 0045BA53
>2'!17,(, xrefs: 0045C399
7+$;86-2, xrefs: 0045C5A6
!$=+, xrefs: 0045B4FC
9-4, xrefs: 0045C2F6
<290, xrefs: 0045C270
!$=+, xrefs: 0045BC2F
'!8, xrefs: 0045BA33
8>., xrefs: 0045C300
&:90, xrefs: 0045BAC2
7+$/29+, xrefs: 0045C5E7
%1, xrefs: 0045C0B6
9-4, xrefs: 0045C2B9

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AttributesCreateDirectoryErrorFileLast
String ID: 9-4$9-4$ $!$=+$!$=+$"/,$"8* $"8* $%1$%1$&:90$&:90$'!8$'!8$)$)$12&1$12&1$7+$/29+$7+$/29+$7+$;86-2$7+$;86-2$8>.$8>.$9:.9$9:.9$<290$<290$<:7>865<$<:7>865<$>2'!17,($>2'!17,($t/$)$w ]p:;-TP$|',!$|',!
API String ID: 674977465-2093587463
Opcode ID: 98b0d257eeace487a820dd65874f182ad37eee071a1dbe34687a9023e96619b4
Instruction ID: f1ec3ed8df4f27eeeafdc384d20f3ca36f04232fc952ab87f7a7b0810dcce7f9
Opcode Fuzzy Hash: 98b0d257eeace487a820dd65874f182ad37eee071a1dbe34687a9023e96619b4
Instruction Fuzzy Hash: DAC29E708042989EDB25EB65CC557DEBBB4AF11308F0401DED44977292EBB81F88DF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00431BE0 Relevance: 41.8, APIs: 1, Strings: 22, Instructions: 1514COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00431C6A

Strings

', xrefs: 00432888
$.(-, xrefs: 00432838
@, xrefs: 00432E13
\, xrefs: 0043255E
|?;2, xrefs: 00432D84, 00432DB1
$.(-, xrefs: 00432737
/',<, xrefs: 0043233A
.:(8, xrefs: 004324D6
/',<, xrefs: 00432872
$.(-, xrefs: 0043278F
|?07, xrefs: 00432EB5, 00432EE2
7=7', xrefs: 004327CE
\, xrefs: 00431DB3
-, xrefs: 0043326A
7;x.:(8, xrefs: 00433177
\, xrefs: 00432A87
\, xrefs: 00432B00
', xrefs: 004327EE
7=7', xrefs: 00432868
7;x, xrefs: 004324CF
/',<, xrefs: 004327D8
7=7', xrefs: 00432333

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: $.(-$$.(-$$.(-$'$'$-$.:(8$/',<$/',<$/',<$7;x$7;x.:(8$7=7'$7=7'$7=7'$@$\$\$\$\$|?07$|?;2
API String ID: 1514166925-1389865942
Opcode ID: 14fb29825fe25cef5644d52a7b6c73922ed2e3d4fefc7c99748425dc69eb5ccf
Instruction ID: 4f9d6433decd39c3757a30e706ca711ed30d3895debe888d9332c55e6a9be982
Opcode Fuzzy Hash: 14fb29825fe25cef5644d52a7b6c73922ed2e3d4fefc7c99748425dc69eb5ccf
Instruction Fuzzy Hash: 08E2BE70D002588BDF24DF68CD487EEBBB1AF55308F1442DED0496B292DBB85B89CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004202AA Relevance: 40.6, Strings: 31, Instructions: 1844COMMON

Download Yara Rule

Strings

"!;3?;=, xrefs: 00421C1B, 00421C44
'!8, xrefs: 00421D7C
$.(-, xrefs: 00420F9D
', xrefs: 004210E8
\, xrefs: 00420908
\, xrefs: 00420892
', xrefs: 0042072A
\, xrefs: 00420D12
\, xrefs: 0042128B
2, xrefs: 004221C5
\, xrefs: 00420369
><3<8$, xrefs: 004220C7, 004220CD
/',<, xrefs: 0042071A
/',<, xrefs: 00421038
$bd, xrefs: 00421869
"2'&!8*=, xrefs: 00421FB5, 00421FDC
', xrefs: 0042104E
$.(-, xrefs: 00420FEF
cannot use operator[] with a string argument with , xrefs: 004222CA, 0042231F
><3<8, xrefs: 00421E5E, 00421E65
\, xrefs: 00420B6F
7=7', xrefs: 004210C8
\, xrefs: 00421307
\, xrefs: 004204DA
N, xrefs: 00422330
\, xrefs: 00420D88
$be, xrefs: 004218AC
7=7', xrefs: 0042102E
$.(-, xrefs: 00421098
/',<, xrefs: 004210D2
7=7', xrefs: 00420713

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "!;3?;=$"2'&!8*=$$.(-$$.(-$$.(-$$bd$$be$'$'$'$'!8$/',<$/',<$/',<$2$7=7'$7=7'$7=7'$><3<8$><3<8$$N$\$\$\$\$\$\$\$\$\$cannot use operator[] with a string argument with
API String ID: 0-1876853861
Opcode ID: efad77fb7c11f0aef965a937dd6e0eb81531518e292c7aab51d29e06fc2dd93b
Instruction ID: 23905bb18fd000cec8556e00b281b5b68f5f5e10fed6cbdd06ccf3518dd8b67d
Opcode Fuzzy Hash: efad77fb7c11f0aef965a937dd6e0eb81531518e292c7aab51d29e06fc2dd93b
Instruction Fuzzy Hash: F403E070D002A8DADF25DF68C844BEEBBB0AF15304F5441DED44967292DBB85B88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0045DDE5 Relevance: 39.0, APIs: 8, Strings: 14, Instructions: 538
librarythreadloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(00000000), ref: 0045DE2C
GetProcAddress.KERNEL32(00000000,00000000), ref: 0045DE74
MessageBoxA.USER32(00000000,00000000,00000000,00000014), ref: 0045DFEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045E088
GetProcessId.KERNELBASE(0000A9BE,00000000,00000000,00000003,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0045E0E5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045E414
SetThreadExecutionState.KERNEL32(80000041), ref: 0045E47D
SetThreadExecutionState.KERNEL32(80000001), ref: 0045E488

Part of subcall function 00414ED0: CoInitializeEx.OLE32(00000000), ref: 00414F21
Part of subcall function 00414ED0: CoCreateInstance.OLE32(0051F29C,00000000,00000001,005264AC,00000000), ref: 00414F5B
Part of subcall function 00414ED0: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 0041500D

Strings

%::=, xrefs: 0045E490
&!!0, xrefs: 0045E10B, 0045E116
VW}8, xrefs: 0045E01C
&!!0, xrefs: 0045E27A, 0045E285
&!!0, xrefs: 0045E37A, 0045E385
gy<5, xrefs: 0045DE0C
>70, xrefs: 0045E4A4
^?, xrefs: 0045E3AD
"#(w, xrefs: 0045E49A
6, xrefs: 0045DE16
&!!0, xrefs: 0045E3EE, 0045E3F9
?9?x, xrefs: 0045DF83
&!!0, xrefs: 0045E3B4, 0045E3BF
$?, xrefs: 0045E3E7

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateExecutionStateThreadUnothrow_t@std@@@__ehfuncinfo$??2@$AddressInitializeInstanceLibraryLoadMessageProcProcess
String ID: "#(w$%::=$&!!0$&!!0$&!!0$&!!0$&!!0$6$>70$?9?x$VW}8$gy<5$$?$^?
API String ID: 3671032131-1329971128
Opcode ID: b326a040ec13b3a0722b3792d31c4eec2e6cc7952a8ad3ba8b0fac31b3da6a70
Instruction ID: cc232912bdbecafd924210c8f3a8d0976e8c52aa9e09a0efcb575e00b7293480
Opcode Fuzzy Hash: b326a040ec13b3a0722b3792d31c4eec2e6cc7952a8ad3ba8b0fac31b3da6a70
Instruction Fuzzy Hash: 2032E274A00614CBCB28CF15C894BAEB7B1FF59309F14419ADD056B392EB74AE49CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0044A8F0 Relevance: 38.1, APIs: 6, Strings: 15, Instructions: 1320COMMON

Download Yara Rule

APIs

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?), ref: 0044AD86
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,?,?,?,06111778,?,?), ref: 0044AF74
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?,?,?,?,?,?,?,161B1778,?,?), ref: 0044B176
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?,10070678,?,?), ref: 0044B404

Strings

{, xrefs: 0044B1E3
>>., xrefs: 0044AACE
z}y|, xrefs: 0044BC9A, 0044BCCC
&80175>>., xrefs: 0044AAF1
175, xrefs: 0044AAC4
type must be boolean, but is , xrefs: 0044C114
&80, xrefs: 0044AABA
, xrefs: 0044C029
$1#, xrefs: 0044AB21
{, xrefs: 0044B0F2
~s, xrefs: 0044AC71
:, xrefs: 0044ABFE
*, xrefs: 0044BCE3
&80, xrefs: 0044AB17
&80115?(, xrefs: 0044AA91, 0044AA9E

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath$AttributesErrorFileLast
String ID: $1#$175$ $ &80$ &80$ &80115?($ &80175>>.$*$:$>>.$type must be boolean, but is $z}y|${${$~s
API String ID: 133263752-2053842511
Opcode ID: 671fa70304b43e5d7022ef0ee260fc848fd2ef3ab9c9c5c3cfc9a361679a5cbf
Instruction ID: edb6fcdc740fcd203abd4a1a4372474ddc1a219639bcc899f6d1fc62923c7786
Opcode Fuzzy Hash: 671fa70304b43e5d7022ef0ee260fc848fd2ef3ab9c9c5c3cfc9a361679a5cbf
Instruction Fuzzy Hash: EEC2D070D002589AEF25DF64C858BEEBBB4AF16304F1081DED44977282EB785B89CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00440C10 Relevance: 37.7, APIs: 9, Strings: 12, Instructions: 926
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,?,00544428,?,><3<8$,?,?,?,00000000), ref: 00440D5B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00440D99
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,00000000), ref: 00440DC8
RegQueryValueExA.ADVAPI32(?,3C353E17,00000000,00000001,?,00000104), ref: 00440EBF
RegQueryValueExA.ADVAPI32(?,05151E1B,00000000,00000001,?,00000104,?,?,?,?,0000002D,?), ref: 00440FEF

Strings

cannot use operator[] with a string argument with , xrefs: 00441D97
><3<8$, xrefs: 00440CAD, 00440CB4
><3<8, xrefs: 00441904, 00441931
!, xrefs: 00441B37
><3<8$, xrefs: 00441BA3, 00441BA6
"2'&!8*=, xrefs: 00441A8B, 00441ABC
),3/, xrefs: 004410B4
'!8, xrefs: 0044175C, 0044178C
,>., xrefs: 00440FB2
"!;3?;=, xrefs: 004415DD, 0044160C
-, xrefs: 00440F29
:, xrefs: 004410BE

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: OpenQueryValue$Enum
String ID: !$"!;3?;=$"2'&!8*=$'!8$),3/$,>.$-$:$><3<8$><3<8$$><3<8$$cannot use operator[] with a string argument with
API String ID: 2712010499-1536734624
Opcode ID: d5483edddbe61dc8d06b703bb21a103f4ed3c9afd3d422cfc491d4559c552cbe
Instruction ID: 2b32559d8a7d614ef5bf6fab99dc021176b483d3f751ddb0dabf5cb0ba90f989
Opcode Fuzzy Hash: d5483edddbe61dc8d06b703bb21a103f4ed3c9afd3d422cfc491d4559c552cbe
Instruction Fuzzy Hash: 2B929B70C002989FEB25CB64CC84BDEBBB4AF55304F1481DAD149A7292EB785BC9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0043CA90 Relevance: 37.1, APIs: 1, Strings: 19, Instructions: 2057COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32(00000000,00000001,00000000,?,?,?,><3<8$,><3<8$,00000001), ref: 0043DFD9

Part of subcall function 0040AF70: GetModuleHandleA.KERNEL32(3930271C), ref: 0040AFE5
Part of subcall function 0040AF70: GetProcAddress.KERNEL32(00000000,12382700), ref: 0040AFF0

Strings

><3<8$, xrefs: 0043CB53, 0043CB83
cannot use operator[] with a string argument with , xrefs: 0043DCF1, 0043DD26, 0043DD76, 0043DDA9, 0043DDFE, 0043E8F4, 0043E946
'!8, xrefs: 0043CFE4
><3<8$, xrefs: 0043D2DB, 0043D30C
hHS, xrefs: 0043E975
8, xrefs: 0043E3FD
'!8, xrefs: 0043D6C6, 0043D6F3
!, xrefs: 0043E905
!8*=, xrefs: 0043E595
"2'&!8*=, xrefs: 0043DA25, 0043DA52
"!;3?;=, xrefs: 0043D53E, 0043D56C
><3<8$, xrefs: 0043DB92, 0043DBC2
8$, xrefs: 0043DEB4
'!8, xrefs: 0043E2C4, 0043E2F1
><3<, xrefs: 0043DEAD
"2'&!8*=, xrefs: 0043D20D, 0043D214
><3<8, xrefs: 0043D875, 0043D8A2
"!;3?;=, xrefs: 0043E185, 0043E1AC
"!;3?;=, xrefs: 0043CE89, 0043CEAC

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressCredEnumerateHandleModuleProc
String ID: !$!8*=$"!;3?;=$"!;3?;=$"!;3?;=$"2'&!8*=$"2'&!8*=$'!8$'!8$'!8$8$8$$><3<$><3<8$><3<8$$><3<8$$><3<8$$cannot use operator[] with a string argument with $hHS
API String ID: 2949927473-1437918641
Opcode ID: a4db88ad71298e35db049359eb4ef705bdaafad226df2a2b64694961d8ebcb9f
Instruction ID: 066672279fb6fdae9836c2dcee111eee1fbb7ccffcc1ffbf2bea6a5a1071ae00
Opcode Fuzzy Hash: a4db88ad71298e35db049359eb4ef705bdaafad226df2a2b64694961d8ebcb9f
Instruction Fuzzy Hash: 4213AC70C002989FDB25DF68C894BEEBBB1AF59304F1481DED44967382DB785A89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0045A490 Relevance: 35.9, Strings: 28, Instructions: 886
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"2 =, xrefs: 0045B1CA
8;78, xrefs: 0045AF2C
), xrefs: 0045A4D8
w ]p, xrefs: 0045AAFB
<290, xrefs: 0045AA31
<290, xrefs: 0045AA61
8;78, xrefs: 0045AC18
'!8, xrefs: 0045B159
), xrefs: 0045AC4B
|',!, xrefs: 0045AF79
6, xrefs: 0045A504
9115, xrefs: 0045A4FA
>(r), xrefs: 0045AF33
%1, xrefs: 0045B0B8
w ^p, xrefs: 0045B241
$28 3, xrefs: 0045AA91
%1, xrefs: 0045A974
6u(%, xrefs: 0045A7F3
>(, xrefs: 0045AC1F
$28 3, xrefs: 0045AAB7
|',!, xrefs: 0045A835
!$=+, xrefs: 0045AC41
"2 =, xrefs: 0045B1FA
!$=+, xrefs: 0045A4CE
&+, xrefs: 0045AF3A
9115, xrefs: 0045A7EC
'!8, xrefs: 0045B182
*, xrefs: 0045A7FA

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AttributesCreateDirectoryErrorFileLast
String ID: !$=+$!$=+$"2 =$"2 =$$28 3$$28 3$%1$%1$&+$'!8$'!8$)$)$*$6$6u(%$8;78$8;78$9115$9115$<290$<290$>($>(r)$w ]p$w ^p$|',!$|',!
API String ID: 674977465-1310367266
Opcode ID: cf79787d20b9fdde4aebdf231145ceb7cdc9beee516a7e86f7579d5da9f20a00
Instruction ID: 443d7c8e7de7a932d6356f6d7193eec45498cc015ea55a0ce504edb69b8ec486
Opcode Fuzzy Hash: cf79787d20b9fdde4aebdf231145ceb7cdc9beee516a7e86f7579d5da9f20a00
Instruction Fuzzy Hash: 8B92A170800298DEDB25DB65C9547DEBBB0AF11308F4401DED44A77292EBB81F89DF9A

Uniqueness

Uniqueness Score: -1.00%

Function 004378A0 Relevance: 34.3, APIs: 4, Strings: 15, Instructions: 1023stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004379A8
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00437A51
GetPrivateProfileStringA.KERNEL32(?,3D203202,00000000,?,00000104,?), ref: 00437B09
lstrlenA.KERNEL32(?), ref: 0043865B

Strings

cannot use operator[] with a string argument with , xrefs: 004386D8, 0043872D
\, xrefs: 00437D4B
\, xrefs: 00437B0F
0>4<, xrefs: 004379D3
<290, xrefs: 00438323, 0043832A
3& :0>45, xrefs: 004385F7, 004385FA
$28 3, xrefs: 00438424, 0043844C
3& :0>45, xrefs: 0043793D, 00437944
, xrefs: 004386E9
1, xrefs: 00437E69
)u53, xrefs: 004379DA
(:$, xrefs: 004381E3
7, xrefs: 004379E1
/, xrefs: 00437C36
E, xrefs: 00437FDB

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: $ 1$$28 3$(:$$)u53$/$0>4<$3& :0>45$3& :0>45$7$<290$E$\$\$cannot use operator[] with a string argument with
API String ID: 1311570089-3057292652
Opcode ID: cf1d678104529869d654caef468fc70614daf93760f940c3c0adcc719c89f986
Instruction ID: ddf5894e4190de8f0e61275d0d4fb3d3b3478f7ba823619425044a5b04d8193a
Opcode Fuzzy Hash: cf1d678104529869d654caef468fc70614daf93760f940c3c0adcc719c89f986
Instruction Fuzzy Hash: 77A20570D04258DBDF24DF64C844BDEBBB4AF19308F1441DEE449A7282EB789A89CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0042EB90 Relevance: 28.0, APIs: 1, Strings: 14, Instructions: 1732COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,00000000), ref: 0042EBF6

Strings

\, xrefs: 0042FCA2
#;,, xrefs: 004303F7
0, xrefs: 0043061C
8."9, xrefs: 0042F253
:$=;, xrefs: 0042F249
\, xrefs: 0042ED97
\, xrefs: 0042EFCB
6, xrefs: 0042F761
\, xrefs: 0042F2CE
\, xrefs: 0042F7EB
#;,, xrefs: 0043017F
#;,, xrefs: 0042FF3F
\, xrefs: 0042FA1D
6, xrefs: 0042ED76

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: #;,$#;,$#;,$0$6$6$8."9$:$=;$\$\$\$\$\$\
API String ID: 1514166925-1881394054
Opcode ID: e1dcbe92a181f29a18b6a48160ac96176308741a0d699b863ec889ea32435a16
Instruction ID: b445a2ad30d8c54ff25b387d12b59af1ff6d145f857a574eb7cb2bfe283ce7ce
Opcode Fuzzy Hash: e1dcbe92a181f29a18b6a48160ac96176308741a0d699b863ec889ea32435a16
Instruction Fuzzy Hash: CE03BE70C00298CBDB25CFA4C9547EEBBB4AF15308F5442EED44967282DBB85B88DF95

Uniqueness

Uniqueness Score: -1.00%

Function 0045CC40 Relevance: 26.9, APIs: 10, Strings: 5, Instructions: 688
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00442BC0: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 00442C53
Part of subcall function 00442BC0: CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442CAF
Part of subcall function 00442BC0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442CE0

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045CCE2
CreateDirectoryA.KERNEL32(?,00000000,-00000034,-0000004C), ref: 0045CE22
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,-00000034,-0000004C), ref: 0045CEB5
CreateDirectoryA.KERNEL32(?,00000000,?,00000000,?,?,-00000034,-0000004C), ref: 0045CF4B
CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,-00000034,-0000004C), ref: 0045D094
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045D1C8
CreateDirectoryA.KERNEL32(?,00000000,-00000034,-0000004C), ref: 0045D2ED
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,-00000034,-0000004C), ref: 0045D39B
CreateDirectoryA.KERNEL32(?,00000000,?,00000000,?,?,-00000034,-0000004C), ref: 0045D44C
CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,-00000034,-0000004C), ref: 0045D583

Strings

:, xrefs: 0045D4CD
1>6*, xrefs: 0045CC96
:, xrefs: 0045CFC3
:2,*, xrefs: 0045D182
&, xrefs: 0045D636

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateDirectory$FolderPath
String ID: &$1>6*$:$:$:2,*
API String ID: 2162323195-767720039
Opcode ID: fb07ffd516cc63e48e0f198ad5df8fc22a19cee968f63295e4c77e99f8e61995
Instruction ID: a11f9bbd75db19bf2036a061469339dd4db8b36148c84a1e59e7a939270b7f62
Opcode Fuzzy Hash: fb07ffd516cc63e48e0f198ad5df8fc22a19cee968f63295e4c77e99f8e61995
Instruction Fuzzy Hash: E962B131D0428CDEDB20DBA4C955BDEBB74AF21308F5400AEE44677182EBB85F89DB56

Uniqueness

Uniqueness Score: -1.00%

Function 0040B300 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 297
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,?,DT,?,?,?,\*.*,00000004), ref: 0040B423
std::_Throw_Cpp_error.LIBCPMT ref: 0040B714
std::_Throw_Cpp_error.LIBCPMT ref: 0040B725

Strings

DT, xrefs: 0040B3B8
\*.*, xrefs: 0040B3B0

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$FileFindFirst
String ID: \*.*$DT
API String ID: 1487763586-2523999094
Opcode ID: 30924590082df6f8f44c65e7c5fb01c90aa8068626bc23e195d49093b75cde99
Instruction ID: ac939954ec097e0f466dd701cbb477dfb9ac36ed8f0a1d488013fd253ef2818d
Opcode Fuzzy Hash: 30924590082df6f8f44c65e7c5fb01c90aa8068626bc23e195d49093b75cde99
Instruction Fuzzy Hash: FCC1CF70D00249CFDB10DFA4C8487EEBBB1FF55314F14426AE044BB292E7B45A88DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0043C800 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE($2!9"440t?01), ref: 0043C845
GetProcAddress.KERNEL32(00000000,?), ref: 0043C890
GetProcAddress.KERNEL32(?), ref: 0043C8CC
GetProcAddress.KERNEL32(39213204), ref: 0043C90B
GetProcAddress.KERNEL32(39213204), ref: 0043C94B
GetProcAddress.KERNEL32(?), ref: 0043C97E
GetProcAddress.KERNEL32(39213204), ref: 0043C9BD
GetProcAddress.KERNEL32(39213204), ref: 0043C9FC
FreeLibrary.KERNEL32 ref: 0043CA51

Strings

$2!9"440t?01, xrefs: 0043C83D, 0043C844
4=(, xrefs: 0043C922
2+, xrefs: 0043C929

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: $2!9"440t?01$2+$4=(
API String ID: 2449869053-1843404136
Opcode ID: f423dc4987d352ac9937d848cd9fb5e714644b23985bd1ebfd8db31034e5f883
Instruction ID: b30b69da85a4116f3a82840f577a0ae83ca26ffad3fe6e2f7a477cc7da58665a
Opcode Fuzzy Hash: f423dc4987d352ac9937d848cd9fb5e714644b23985bd1ebfd8db31034e5f883
Instruction Fuzzy Hash: 4A710270814288CAEB09CFA4E8487EEBBF8EF2A308F10406ED444BA621D375461DDF65

Uniqueness

Uniqueness Score: -1.00%

Function 0041E220 Relevance: 18.3, APIs: 12, Instructions: 260
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(0000036C,0000FFFF,00001006,?,00000008), ref: 0041E2B2
recv.WS2_32(?,00000004,00000002), ref: 0041E2CD
WSAGetLastError.WS2_32 ref: 0041E2D1
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 0041E34F
recv.WS2_32(00000000,0000000C,00000008), ref: 0041E370
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 0041E40C
recv.WS2_32(00000000,?,00000008), ref: 0041E427

Part of subcall function 0041D430: WSAStartup.WS2_32 ref: 0041D45A
Part of subcall function 0041D430: getaddrinfo.WS2_32(?,?,?,00544318), ref: 0041D4DC
Part of subcall function 0041D430: socket.WS2_32(?,?,?), ref: 0041D4FD
Part of subcall function 0041D430: connect.WS2_32(00000000,?,?), ref: 0041D511
Part of subcall function 0041D430: closesocket.WS2_32(00000000), ref: 0041D51D
Part of subcall function 0041D430: freeaddrinfo.WS2_32(?,?,?,?,00544318,?,?), ref: 0041D52A
Part of subcall function 0041D430: WSACleanup.WS2_32 ref: 0041D530

recv.WS2_32(?,00000004,00000008), ref: 0041E52F
__Xtime_get_ticks.LIBCPMT ref: 0041E536
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041E544
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 0041E5BD
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 0041E5C5

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: recv$Sleepsetsockopt$CleanupErrorLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectfreeaddrinfogetaddrinfosocket
String ID:
API String ID: 4125349891-0
Opcode ID: 580c8232041fafc6c313b0223a4dc36542a08a78d0ad8692d06638b5ea451f28
Instruction ID: 445f019a92e67a07c5577944838b6ba889f153fe2f7e7f97530082f2635256d3
Opcode Fuzzy Hash: 580c8232041fafc6c313b0223a4dc36542a08a78d0ad8692d06638b5ea451f28
Instruction Fuzzy Hash: BFB1BB74D00208DFDB10DFA5DC49BDEBBB1BF55308F20421AE514AB2D2E7B85989DB85

Uniqueness

Uniqueness Score: -1.00%

Function 004224D9 Relevance: 17.4, Strings: 13, Instructions: 1131COMMON

Download Yara Rule

Strings

, xrefs: 004233E7
cannot use operator[] with a string argument with , xrefs: 00423604
(:$, xrefs: 00422FCE
\, xrefs: 004225E2
<290, xrefs: 004230FE, 00423105
@, xrefs: 0042338B
(:$, xrefs: 00422FAF
#;,, xrefs: 00423324
3& :0>45, xrefs: 004234C4, 004234C7
), xrefs: 00423615
\, xrefs: 00422B96
$28 3, xrefs: 00423205, 0042322C
\, xrefs: 00422C0E

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $#;,$$28 3$(:$$(:$$)$3& :0>45$<290$@$\$\$\$cannot use operator[] with a string argument with
API String ID: 0-679915065
Opcode ID: f4ce3e09bb1f6dc4405848f6facc84ebd0473553681d84de9085b5a15f287adc
Instruction ID: bd44913ac096deb082ad73b4e6b56e58228a4cafe484209f312c39f122f53dde
Opcode Fuzzy Hash: f4ce3e09bb1f6dc4405848f6facc84ebd0473553681d84de9085b5a15f287adc
Instruction Fuzzy Hash: F0A2F170E002689BDB14DF68D9447EEBBB0BF15304F14419EE449AB382DB78AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00422852 Relevance: 14.6, Strings: 11, Instructions: 811COMMON

Download Yara Rule

Strings

, xrefs: 004233E7
cannot use operator[] with a string argument with , xrefs: 00423604
(:$, xrefs: 00422FCE
<290, xrefs: 004230FE, 00423105
3& :0>45, xrefs: 004234C4, 004234C7
, xrefs: 00423315
(:$, xrefs: 00422FAF
), xrefs: 00423615
\, xrefs: 00422B96
$28 3, xrefs: 00423205, 0042322C
\, xrefs: 00422C0E

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $ $$28 3$(:$$(:$$)$3& :0>45$<290$\$\$cannot use operator[] with a string argument with
API String ID: 0-3638146340
Opcode ID: 64b2a237422e15c23b1dbf90addf676b975125643fa182a2141d73a306c2725e
Instruction ID: eb2dd55f6141e2d675d9ff2e9574dc4233fb147083f3686e6ff04d1ed0a00ccf
Opcode Fuzzy Hash: 64b2a237422e15c23b1dbf90addf676b975125643fa182a2141d73a306c2725e
Instruction Fuzzy Hash: AC72E270E00268DBDB24DF68D9447EEBBB0BF15304F14429ED44967382DB789A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040C490 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 416registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF30: GetCurrentProcess.KERNEL32(00000000,?,?,0040C4BE), ref: 0040AF3F
Part of subcall function 0040AF30: IsWow64Process.KERNEL32(00000000,?,0040C4BE), ref: 0040AF46

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,-00020019,00000000,3B3F3D07,3B3F3D08,00000000), ref: 0040C571
RegQueryValueExA.KERNELBASE(00000000,3D37321F,00000000,00020019,?,00000400), ref: 0040C5D1
RegCloseKey.ADVAPI32(00000000), ref: 0040C600
GetCurrentHwProfileA.ADVAPI32(?), ref: 0040C687

Strings

_, xrefs: 0040C6E6
___, xrefs: 0040C6FE, 0040C726
9 6, xrefs: 0040C60F
_, xrefs: 0040C6D1

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CurrentProcess$CloseOpenProfileQueryValueWow64
String ID: 9 6$_$_$___
API String ID: 165412945-709806127
Opcode ID: 5cd2a4df2292861caf53cffa11f71afccab2696aa57efb9352eba9039fe28151
Instruction ID: b6e6a19ac1b1cbb26a093045ac3f8d51f6027d5e17e321542ac0e50d899cf592
Opcode Fuzzy Hash: 5cd2a4df2292861caf53cffa11f71afccab2696aa57efb9352eba9039fe28151
Instruction Fuzzy Hash: F502E370C00258DEDB15CFA4C894BEEBB74AF15308F1442AEE44577292EBB95B88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004160B0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162processlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(3B263619,?), ref: 00416186
GetProcAddress.KERNEL32(00000000,34312111), ref: 00416191
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004161E1

Strings

t?01, xrefs: 0041627E
D, xrefs: 004160EB
3;kk, xrefs: 0041615A
589., xrefs: 0041612C

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressCreateHandleModuleProcProcess
String ID: 3;kk$589.$D$t?01
API String ID: 3485509086-2234503220
Opcode ID: 60fdf11987f52a907e9139c4ff7ff0b270cfe81cb3f605bd94377336c0d26766
Instruction ID: 584c3f6ed54951fa46cdd62f7e73c497529d8eb16fd8f44b13c31fb8133d280f
Opcode Fuzzy Hash: 60fdf11987f52a907e9139c4ff7ff0b270cfe81cb3f605bd94377336c0d26766
Instruction Fuzzy Hash: AE51F170E00258AFDB14CFA8CC85BEEBBB4FF44704F14419EE509AB292D778A945CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00422360 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 365COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,3& :0>45,?,?,?,?), ref: 00422491

Strings

cannot use operator[] with a string argument with , xrefs: 004235A0, 00423604
3& :0>45, xrefs: 004223FE, 00422405
#;,, xrefs: 004229E3
), xrefs: 00423615
\, xrefs: 00422C0E

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: #;,$)$3& :0>45$\$cannot use operator[] with a string argument with
API String ID: 1514166925-1855882293
Opcode ID: 3ebb378d9fe853fa1044d13e6eee951fc921af984e79a2ceff0af9d13f019fc0
Instruction ID: 2cac8e893caf096c73f10a18816257fa98d3f374838489ee5a6c4980580f9952
Opcode Fuzzy Hash: 3ebb378d9fe853fa1044d13e6eee951fc921af984e79a2ceff0af9d13f019fc0
Instruction Fuzzy Hash: 6EF1BD70D04268DADB14DF64C955BDEBBB4BF15308F1482DEE44967282DBB81B88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00406430 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 352COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004065C1
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004065FE
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004066F1
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0040673E

Strings

., xrefs: 00406710

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 8417005a20e023fd73ba9afad58ff86ec2193d77c7355dce5408bdd34dd6c1b5
Instruction ID: 0ef23cfc4c65f78b20a5b115fbe71865ac88f3790106b09d81af8426c26c804f
Opcode Fuzzy Hash: 8417005a20e023fd73ba9afad58ff86ec2193d77c7355dce5408bdd34dd6c1b5
Instruction Fuzzy Hash: 5AD1D071900616DFCB20CF58C8947AEB7B4FF48328F15466AD816A77C0D73AAD65CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA10 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 271fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0100790E,?,?,0100790E,0100790F), ref: 0041FAA5

Strings

\, xrefs: 0041FB3B

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: \
API String ID: 1974802433-2967466578
Opcode ID: 5bbcc126d914579265a40fd4ca7be5a57979520a1f4ae4eeccc74d064bc25890
Instruction ID: 0eabd7acd7812341df4d8f5e7d8ba5b9313bc1fcfed4fcfaeac043b0cd9dd738
Opcode Fuzzy Hash: 5bbcc126d914579265a40fd4ca7be5a57979520a1f4ae4eeccc74d064bc25890
Instruction Fuzzy Hash: F8B1D0708002498FDF15CFA8C8587FEBBB0BF15308F14425EE455AB292D7785A8ADB94

Uniqueness

Uniqueness Score: -1.00%

Function 00431430 Relevance: 8.0, Strings: 6, Instructions: 493COMMON

Download Yara Rule

Strings

n: , xrefs: 00430FE9
(, xrefs: 0043199C
' 1'865<, xrefs: 0043121D, 00431224
P.^, xrefs: 004314D9
-, xrefs: 00431853
-, xrefs: 0043187D

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID: ' 1'865<$($-$-$P.^$n:
API String ID: 2638373210-269613232
Opcode ID: 6a59506fcf7738322d9559557d0deef2654a8dbb9e461e260b90984ace6356b8
Instruction ID: 06e47fb3e71705996d4c10820d621363cd6d4ebf6feef214284d50ab64b5b3c6
Opcode Fuzzy Hash: 6a59506fcf7738322d9559557d0deef2654a8dbb9e461e260b90984ace6356b8
Instruction Fuzzy Hash: 0722D170D00288DFDF14DFA8C9597EDBBB0AF15308F14819ED445AB382EBB85A48DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0045D9F0 Relevance: 7.7, APIs: 5, Instructions: 159sleepCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 0045DA07
GetCursorPos.USER32(?), ref: 0045DA15
Sleep.KERNELBASE(000003E9,?,?,00000000,?,?,?,?,?,?,?,?,0045DDB8), ref: 0045DACA
GetCursorPos.USER32(?), ref: 0045DAD1
Sleep.KERNELBASE(00000001,?,?,00000000,?,?,?,?,?,?,?,?,0045DDB8), ref: 0045DB87

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cursor$Sleep
String ID:
API String ID: 1847515627-0
Opcode ID: 1305e8b84abd8f11ed362210ed92b6921c6aed97f625362779b6103c1612edfd
Instruction ID: e8049105a74d3e0261715eac98f4d2121e3debad5535f3f1e8485cbb4cdad7bb
Opcode Fuzzy Hash: 1305e8b84abd8f11ed362210ed92b6921c6aed97f625362779b6103c1612edfd
Instruction Fuzzy Hash: 70519A31A082428FCB24CF18C4D0E6AB7E2EF89705F19499EE8859B352D735FD49CB85

Uniqueness

Uniqueness Score: -1.00%

Function 004CB3C0 Relevance: 6.9, Strings: 4, Instructions: 1918COMMON

Download Yara Rule

Strings

min, xrefs: 004CCC6B
too many terms in compound SELECT, xrefs: 004CB666
only a single result allowed for a SELECT that is part of an expression, xrefs: 004CB6AC
max, xrefs: 004CCCCE

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: max$min$only a single result allowed for a SELECT that is part of an expression$too many terms in compound SELECT
API String ID: 0-2877691265
Opcode ID: fbd03b09731f7fb73b0834140c81151357748eaef8a73ae9651058b7b71b28cb
Instruction ID: c1929985df6c20adc65602af42118a6c04867d104e31f5cdb5b9dcf57f3213a0
Opcode Fuzzy Hash: fbd03b09731f7fb73b0834140c81151357748eaef8a73ae9651058b7b71b28cb
Instruction Fuzzy Hash: 881356746047418FD724DF19C090F2ABBE1FF85308F15896EE98A8B352DB79E845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00491D10 Relevance: 6.2, APIs: 4, Instructions: 152fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000003,00000000,7FFFFFFD,?,00000000), ref: 00491D26
CreateFileA.KERNEL32(?,?,00000003,00000000,?,?,00000000,89005445), ref: 00491D2E
GetDiskFreeSpaceW.KERNELBASE(00000000,?,?,?,?), ref: 00491E5C
GetDiskFreeSpaceA.KERNEL32(00000000,?,?,?,?), ref: 00491E92

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateDiskFileFreeSpace
String ID:
API String ID: 3321825543-0
Opcode ID: 43ba0cbec80b2fa17c53ea0a5cf93c85ec04918b9e4dfa6bcad75a6e981aae53
Instruction ID: 83f738b45ce3571a5b1a543967aa25571774c38b0d664623fa16f6a30307302f
Opcode Fuzzy Hash: 43ba0cbec80b2fa17c53ea0a5cf93c85ec04918b9e4dfa6bcad75a6e981aae53
Instruction Fuzzy Hash: DB4111716042029FDF21CF24D844BABBBE4EF80318F04467FF88582260E739D85ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 004F636F Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004F67B4,00000000,00000000,00000000), ref: 004F6673

Strings

W. Europe Summer Time, xrefs: 004F6720
W. Europe Standard Time, xrefs: 004F670C

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 565725191-690618308
Opcode ID: 37dc3693d64b196c5e882212cddad6af1e0f65f0a5ddd334e881fb4f22ef6d2f
Instruction ID: 9cad27d5f2b54b569fbe64af901152f9cd98cd860f96ba3425b9b03ecf62c301
Opcode Fuzzy Hash: 37dc3693d64b196c5e882212cddad6af1e0f65f0a5ddd334e881fb4f22ef6d2f
Instruction Fuzzy Hash: 91C12672D00119ABDB14BB65DC02ABF7BB9EF04758F11406BFA01EB295E7389E01D798

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000000,000000FF), ref: 0041F3E5
LocalFree.KERNEL32(?), ref: 0041F414

Strings

jjjj, xrefs: 0041F3D9

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID: jjjj
API String ID: 1561624719-48926182
Opcode ID: aa4404672b2df8b18a26a615dff9fcff1f65acf6459e9ad9dae77a66ff4ba265
Instruction ID: 409469ce869bb278a755ece448acb5b2db033f64c44fe4e4698fcece5c69adc3
Opcode Fuzzy Hash: aa4404672b2df8b18a26a615dff9fcff1f65acf6459e9ad9dae77a66ff4ba265
Instruction Fuzzy Hash: DDF0A7B2C4011896DF109BA49C01BEFB765FB54721F004037DC59A3340EB3948898ADA

Uniqueness

Uniqueness Score: -1.00%

Function 004DB1CB Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,0046BEC7,?,00000000,?,00473681,?,00000000), ref: 004DB1D7
FindFirstFileExW.KERNELBASE(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,0046BEC7,?,00000000,?,00473681,?,00000000), ref: 004DB206
GetLastError.KERNEL32(?,0046BEC7,?,00000000,?,00473681,?,00000000), ref: 004DB218

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: f1d414bdb1a830b9c19e1c1a91ab6db378ddacdc0024ae8e2650c4f043538abd
Instruction ID: 8aa795b071709f9ad919938827d4aff15d16b66e82d9f8c16838a8eaa28f277c
Opcode Fuzzy Hash: f1d414bdb1a830b9c19e1c1a91ab6db378ddacdc0024ae8e2650c4f043538abd
Instruction Fuzzy Hash: D9F05431000508FFDB111FA5DC189AF7B9CEF143B0B108627BD68C56A0D73199A296E4

Uniqueness

Uniqueness Score: -1.00%

Function 00496450 Relevance: 2.0, APIs: 1, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47df8a979cf4f857dc537b9ef44913b95696ce48800f52ac5a31c4eb421a18d
Instruction ID: e16f3952025df4b57fbfa53020dcabc30b9a59b88706b4710c7fb5b6fa6fa324
Opcode Fuzzy Hash: f47df8a979cf4f857dc537b9ef44913b95696ce48800f52ac5a31c4eb421a18d
Instruction Fuzzy Hash: D4028EB06047019FDB64CF29C840B27BBE0AF89314F15493EE48AC7751DB78E949CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00491C30 Relevance: 1.6, APIs: 1, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000003,00000000,7FFFFFFD,?,00000000), ref: 00491D26

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d5e735c4d325f6863c4bbb0d8d2f27c6b16101442465d86a64dd5004bcde936b
Instruction ID: ea3f12589498c6031ede0a0e63da1aa6e190ef39183c8d3f3956d1ebbf566a56
Opcode Fuzzy Hash: d5e735c4d325f6863c4bbb0d8d2f27c6b16101442465d86a64dd5004bcde936b
Instruction Fuzzy Hash: D531BF716043069BDB10CF29D845B9BBBE5EBC4364F144A3EF858833A0E339D905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004E925D Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 004E93E1

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 79f90e00dc77957be7610ff531ea09f8d3cb8def4dcd7f8d4dea2ba9a82dffaa
Instruction ID: b0f2f4a4c71a32763588803a0d4209da0bfab023c608772363e77a77a94ad2d5
Opcode Fuzzy Hash: 79f90e00dc77957be7610ff531ea09f8d3cb8def4dcd7f8d4dea2ba9a82dffaa
Instruction Fuzzy Hash: 30B1E17190468A9BCB35CF6BC4956BFB7A1AF08306F140A1FD992973C1C739AD02CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00490E40 Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

k0K, xrefs: 0049103A

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: k0K
API String ID: 0-2240500536
Opcode ID: 5f99f82bc59ae3eaf0481f485006e98992b18bd68afbdb37dbad8402f605a7b4
Instruction ID: 58ae69e5487afc1ab35260876bc7a5fe83d503e72c09194b2d23b77358996077
Opcode Fuzzy Hash: 5f99f82bc59ae3eaf0481f485006e98992b18bd68afbdb37dbad8402f605a7b4
Instruction Fuzzy Hash: 2AB16B74A016069FDB14CF6AC48065AFBF1FF49314B28C57ED8198B711E736E951CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0048C560 Relevance: .7, Instructions: 663COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aead1b18fa6655e2046488e2d56f3586447149cbf6bdb60b8fae25e10e23de9f
Instruction ID: d460b15ecaef89ee619ee12d19a6560aac0686608ff237d971a34b1c2572f41b
Opcode Fuzzy Hash: aead1b18fa6655e2046488e2d56f3586447149cbf6bdb60b8fae25e10e23de9f
Instruction Fuzzy Hash: 4342B070A006458FDB14EE78C8807AEFBA1FF45310F148A6ED4A5E7781D738E54ACBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0048D250 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0702e79ebe35d7f2eab4924e86644c543a8bfec9af84c7524f60a6a2cffea22b
Instruction ID: 0f76039a442bb9952bef901009f789ffb67366a02fe10e258d8ab1312df69022
Opcode Fuzzy Hash: 0702e79ebe35d7f2eab4924e86644c543a8bfec9af84c7524f60a6a2cffea22b
Instruction Fuzzy Hash: C2B19F71A057019FC720EE69C840A5BB7E1EF88324F144F2EF8AAD3790D778E9458B56

Uniqueness

Uniqueness Score: -1.00%

Function 00442BC0 Relevance: 219.9, APIs: 40, Strings: 84, Instructions: 2868fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 00442C53
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442CAF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004434EF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443639
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0044337F

Part of subcall function 0040E7B0: FindFirstFileA.KERNEL32(00000000,7F7A790F,?,7F7A790E,00445E27,00000000,7F7A790E,7F7A790F,74DF3100,?), ref: 0040E929

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442CE0

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442E08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442E37
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00442F2F
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443029
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443087
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004431B8
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0044324A

Strings

?)/, xrefs: 004447F9
864, xrefs: 00444D02
2, xrefs: 00445A50
w Y_[], xrefs: 004445DC, 004445E2
315, xrefs: 00442CF2
34*8, xrefs: 0044320A
?(, xrefs: 0044527D
)u(%, xrefs: 00443BAE
.4.<, xrefs: 00444EA6
2, xrefs: 0044597E
t224, xrefs: 00442EE6
9"6-, xrefs: 00445A3C
%1, xrefs: 0044455F
.4.<, xrefs: 00444E0C
7;x, xrefs: 00444E9A
&2, xrefs: 0044485C
1<:3, xrefs: 00443E3F
|76, xrefs: 00445641
*, xrefs: 00443BB8
|::<, xrefs: 0044562A, 0044562D
"83<, xrefs: 00444520
?), xrefs: 004436B9
</, xrefs: 00443214
.4.<, xrefs: 00444DAA
?(, xrefs: 00445195
6:, xrefs: 00442C7A
759*, xrefs: 004451E3
315, xrefs: 00442C70
759*, xrefs: 00445271
k, xrefs: 00444B9A
3:, xrefs: 00443051
)u$0, xrefs: 00445A46
_, xrefs: 00444676
&+, xrefs: 00444534
9:, xrefs: 00444EB0
7:, xrefs: 00443FFD
9"6-, xrefs: 0044596A
"?=+, xrefs: 0044388C
4(r), xrefs: 0044452A
)u$0, xrefs: 004459E8
7;x, xrefs: 00444DA0
!#7), xrefs: 00443047
)u6., xrefs: 004439BF
1>6, xrefs: 00445807
0>?, xrefs: 00444477
9:, xrefs: 00444E16
0(33, xrefs: 004452EE
6:, xrefs: 00442CFC
11, xrefs: 004439C9
0>?, xrefs: 004443CF
4>(, xrefs: 00443CBF
759*, xrefs: 0044518B
;26-, xrefs: 004449D9
! 2;, xrefs: 0044420F, 00444212
864, xrefs: 00444CA1
3>2), xrefs: 00443A65
?0, xrefs: 00443E49
0>?w, xrefs: 004452E4
9"6-, xrefs: 00443BA4
1,), xrefs: 00442EDC
0(33, xrefs: 00445369
9"6-, xrefs: 004439B5
3$, xrefs: 00442FEB
$'4<, xrefs: 0044585E
";=w, xrefs: 00443CB5
?(, xrefs: 004451ED
9:, xrefs: 00444DB4
0+, xrefs: 004438A0
., xrefs: 00443172
4>(, xrefs: 00443C5A
#9;1, xrefs: 004436AF
)u$0, xrefs: 00445974
0>?, xrefs: 00444374
7;x, xrefs: 00444E02
0>?w, xrefs: 0044535F
+, xrefs: 00445E83
|';-, xrefs: 004455FF, 00445602
";=w, xrefs: 00443C50
%26>, xrefs: 004447EF
3y<8, xrefs: 00443168
ghi, xrefs: 00444B90
2, xrefs: 004459F2
9"6-, xrefs: 004459DE
61, xrefs: 00443E15

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CreateDirectory$Copy$FolderPath$AttributesErrorFindFirstLast
String ID: 1,)$ghi$! 2;$!#7)$"83<$";=w$";=w$"?=+$#9;1$$'4<$%1$%26>$&+$&2$)u$0$)u$0$)u$0$)u(%$)u6.$*$+$.$.4.<$.4.<$.4.<$0(33$0(33$0+$0>?$0>?$0>?$0>?w$0>?w$11$1<:3$1>6$2$2$2$315$315$3$$34*8$3:$3>2)$3y<8$4(r)$4>($4>($61$6:$6:$759*$759*$759*$7:$7;x$7;x$7;x$864$864$9"6-$9"6-$9"6-$9"6-$9"6-$9:$9:$9:$;26-$</$?($?($?($?)$?)/$?0$_$k$t224$w Y_[]$|';-$|76$|::<
API String ID: 3765264142-139938508
Opcode ID: 990ac86eb2dbed40e8dcdc6bd6bfd7758b5164ccb475ca9b4540de2ca0c5392f
Instruction ID: 3de45bc02bde8f5d1410f05e926e2ccc20553a8a2b94b07571620541858a5efa
Opcode Fuzzy Hash: 990ac86eb2dbed40e8dcdc6bd6bfd7758b5164ccb475ca9b4540de2ca0c5392f
Instruction Fuzzy Hash: 4C538D70C04298DADB21EB65CD557DEBB74AF21308F4441EAD449772C2EBB81B88CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00474AC0 Relevance: 37.6, APIs: 16, Strings: 5, Instructions: 890
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00474FE3
___std_exception_destroy.LIBVCRUNTIME ref: 00474FF7
___std_exception_destroy.LIBVCRUNTIME ref: 0047510F
___std_exception_destroy.LIBVCRUNTIME ref: 00475123
___std_exception_destroy.LIBVCRUNTIME ref: 004751E0
___std_exception_destroy.LIBVCRUNTIME ref: 004751FA
___std_exception_destroy.LIBVCRUNTIME ref: 00475369
___std_exception_destroy.LIBVCRUNTIME ref: 0047537D
___std_exception_destroy.LIBVCRUNTIME ref: 00475452
___std_exception_destroy.LIBVCRUNTIME ref: 00475466
___std_exception_destroy.LIBVCRUNTIME ref: 0047554C
___std_exception_destroy.LIBVCRUNTIME ref: 00475560
___std_exception_destroy.LIBVCRUNTIME ref: 00475811
___std_exception_destroy.LIBVCRUNTIME ref: 00475825

Strings

O, xrefs: 0047582D
number overflow parsing ', xrefs: 0047514A
object, xrefs: 00475391
value, xrefs: 00475752
array, xrefs: 004752AA

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: O$array$number overflow parsing '$object$value
API String ID: 4194217158-306733086
Opcode ID: cb63a8b2e461e91bcb32e0d98c3f644b59a248b0a224de03e7edc05735470389
Instruction ID: 2b8bbb5fb6bef53096142a6844d47d0bb0a5a7ac0895a6da9de1fd59fd81eee6
Opcode Fuzzy Hash: cb63a8b2e461e91bcb32e0d98c3f644b59a248b0a224de03e7edc05735470389
Instruction Fuzzy Hash: 4192A170C00248DEDB10DFA4C944BEEBFB5BF55304F14859ED459BB282E7786A48CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004103C0 Relevance: 14.7, APIs: 2, Strings: 6, Instructions: 746COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,0000005C), ref: 00410419
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00410440

Strings

z, xrefs: 00411A43
$39, xrefs: 0041211E
9>6, xrefs: 00412F18
12*y, xrefs: 00412702
\, xrefs: 0040F8DF
9%!, xrefs: 0041164A

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: $39$12*y$9%!$9>6$\$z
API String ID: 1514166925-764209152
Opcode ID: 81d9ec1db920eedd9979d0c7e50ac6c10eba50d94bcfc26e85fa224c19e26f48
Instruction ID: 59b6d6f339ba7e2f22b0134f03f68e765181b61f31e9b392b5e3c28a430878f0
Opcode Fuzzy Hash: 81d9ec1db920eedd9979d0c7e50ac6c10eba50d94bcfc26e85fa224c19e26f48
Instruction Fuzzy Hash: E772DE70C0029D9ACF25DB64CD557EEB774AF15308F0442EAD04977292EBB82B89CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0040CAC0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 171registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNELBASE(80000002,?,34393C16,0001FFFF,00000001,?,00000104), ref: 0040CBD2
GetComputerNameExA.KERNELBASE(00000002,?,00000104), ref: 0040CC3C
LsaOpenPolicy.ADVAPI32(00000000,0054267C,00000001,00000000), ref: 0040CC95
LsaQueryInformationPolicy.ADVAPI32(00000000,0000000C,?), ref: 0040CCA8
LsaFreeMemory.ADVAPI32(?), ref: 0040CCD6
LsaClose.ADVAPI32(00000000), ref: 0040CCDF

Strings

?9, xrefs: 0040CB52
%wZ, xrefs: 0040CCC5

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ$?9
API String ID: 762890658-830384695
Opcode ID: a14e4553e443ecd4be1b87ce77b34667ff650a3cf470428272776160caaff946
Instruction ID: 5c12321940df4fd8fb71f447f481a877f50f156e5d1b3200ddc0c7ffc2d86234
Opcode Fuzzy Hash: a14e4553e443ecd4be1b87ce77b34667ff650a3cf470428272776160caaff946
Instruction Fuzzy Hash: 3B612671804348DBEB11DFA4DC49BEEBBB8FF09708F00426EE545B6182E7B55689CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00439A80 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 119COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00439BA8
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00439C52

Strings

)u53, xrefs: 00439BDA
7, xrefs: 00439BE1
1<;>, xrefs: 00439B05
?2+, xrefs: 00439B0C
TbE, xrefs: 00439BAE
0>4<, xrefs: 00439BD3

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderNamesPathPrivateProfileSection
String ID: )u53$0>4<$1<;>$7$?2+$TbE
API String ID: 2478605195-2592757414
Opcode ID: 1606ea9120c7d04a6346da00d7890c6e7c48432ada12fe9634ef06a45c9dc041
Instruction ID: 7174201a8848e788bf8bea569bcfc7b55b4c84013191dce98e5d5293a2ecbe93
Opcode Fuzzy Hash: 1606ea9120c7d04a6346da00d7890c6e7c48432ada12fe9634ef06a45c9dc041
Instruction Fuzzy Hash: 18519E74905398EEDB11DFA4CC45BCDBBB4AF15304F1040DAE549AB282D7B86B88CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0041D840 Relevance: 13.0, APIs: 4, Strings: 3, Instructions: 713libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,?,00000000,00000000,00000000), ref: 0041DBB6
GetProcAddress.KERNEL32(00000000,06150005), ref: 0041DBC1
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 0041DBD6
GetCurrentProcess.KERNEL32(00000000,?,?,?,00000000,00000000,00000000), ref: 0041DEDC

Strings

Ws2_32.dll, xrefs: 0041DBAD
%1, xrefs: 0041DF09
39<, xrefs: 0041DB95

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcessSend
String ID: %1$39<$Ws2_32.dll
API String ID: 3060695839-1710563983
Opcode ID: 7e2e5bfa8d89abbe3152043b2327a7d30498876b6f1498a89903fe981372744d
Instruction ID: bb544734cddad546c251b080f02150c0b6b95f0d694eae3eeb7ddbcd143b20fb
Opcode Fuzzy Hash: 7e2e5bfa8d89abbe3152043b2327a7d30498876b6f1498a89903fe981372744d
Instruction Fuzzy Hash: EE6225B0D04288DEDF10DFA8C9557EEBFB0AF15308F24415ED4456B282E7B85A88DBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0040B1A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207
std::_Throw_Cpp_error.LIBCPMT ref: 0040B24F
std::_Throw_Cpp_error.LIBCPMT ref: 0040B260

Strings

DT, xrefs: 0040B3B8
DT, xrefs: 0040B238
\*.*, xrefs: 0040B3B0

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID: \*.*$DT$DT
API String ID: 995686243-3062393244
Opcode ID: 7c93be0e39bac07192ae234e4444476cb8469c1607e3cac452f8ce700f80683a
Instruction ID: 98fd9ba19aa43d818a037ed0b56ad2d2959cead2aa0cd36f25e414e829a489f2
Opcode Fuzzy Hash: 7c93be0e39bac07192ae234e4444476cb8469c1607e3cac452f8ce700f80683a
Instruction Fuzzy Hash: 65110371940600E7CB205BA8A809BBE3654E713728F2087BFD425B77D0D73989048ADE

Uniqueness

Uniqueness Score: -1.00%

Function 0041D430 Relevance: 12.1, APIs: 8, Instructions: 92networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 0041D45A
getaddrinfo.WS2_32(?,?,?,00544318), ref: 0041D4DC
socket.WS2_32(?,?,?), ref: 0041D4FD
connect.WS2_32(00000000,?,?), ref: 0041D511
closesocket.WS2_32(00000000), ref: 0041D51D
freeaddrinfo.WS2_32(?,?,?,?,00544318,?,?), ref: 0041D52A
WSACleanup.WS2_32 ref: 0041D530
freeaddrinfo.WS2_32(?,?,?,?,00544318,?,?), ref: 0041D545

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: freeaddrinfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 58224237-0
Opcode ID: 1366ad5779fb1d9e896f6c3f08975c03dc1aab9f9250e2a0f463ba84f3e17d7b
Instruction ID: 3c9476e75c3fd4fec55e94a635383449f643eb380b6605d060e559485908137f
Opcode Fuzzy Hash: 1366ad5779fb1d9e896f6c3f08975c03dc1aab9f9250e2a0f463ba84f3e17d7b
Instruction Fuzzy Hash: A431C472904710ABC7209F25DC486ABB7E5BBD4368F104B1EF8B4932A0E374A8489656

Uniqueness

Uniqueness Score: -1.00%

Function 00407490 Relevance: 11.1, APIs: 1, Strings: 5, Instructions: 571COMMON

Download Yara Rule

APIs

Part of subcall function 004778C0: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00477949
Part of subcall function 004778C0: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00477991

GetFileAttributesA.KERNELBASE(?), ref: 004077C1

Strings

recursive_directory_iterator::recursive_directory_iterator, xrefs: 00407CE3
.zip, xrefs: 004075A1
/, xrefs: 00407914
, xrefs: 00407B96
\, xrefs: 004078DB

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_fs_convert_narrow_to_wide@20$AttributesFile
String ID: $.zip$/$\$recursive_directory_iterator::recursive_directory_iterator
API String ID: 2896367778-1520678085
Opcode ID: 2fad60e87e1e802c277f3282e679dfa3b8b58277df00ea7f9a444588ff8a1a58
Instruction ID: 83cbc35ccc226e9dfc96b22cc8f0aa30fdcd4d5be8d4862c17add94487e3c136
Opcode Fuzzy Hash: 2fad60e87e1e802c277f3282e679dfa3b8b58277df00ea7f9a444588ff8a1a58
Instruction Fuzzy Hash: 55429D70D05258DFDB10DFA8C9587DEBBB0BF15308F14819DE4097B282DB785A88CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0046CA20 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 523COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0046CCC0
___std_exception_destroy.LIBVCRUNTIME ref: 0046CCDA
___std_exception_destroy.LIBVCRUNTIME ref: 0046D09A
___std_exception_destroy.LIBVCRUNTIME ref: 0046D0B4

Strings

., xrefs: 0046D156
value, xrefs: 0046CBF7, 0046CFCE

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: .$value
API String ID: 4194217158-1166439862
Opcode ID: 114bf2fada0c8a335dc6e4dc59675e49d0fca1bc34742518db17b52a0daaae50
Instruction ID: 6bb52dc470a67732b65bfa6fba687dde157c2efc00668daf5dfdc611f465addf
Opcode Fuzzy Hash: 114bf2fada0c8a335dc6e4dc59675e49d0fca1bc34742518db17b52a0daaae50
Instruction Fuzzy Hash: 09328D70D01288DEDB14CFA9C9547EEBBB1AF15304F24819EE458AB382E7785B48DF52

Uniqueness

Uniqueness Score: -1.00%

Function 004F1AC4 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 712faec5eeebce6baaee8b13617faba26b3b358921950160ad50f9a09d9e58b7
Instruction ID: e1f0bbcd43b77d7626f4e77856158d48870e96d21c9a9c54683f95f8a13591de
Opcode Fuzzy Hash: 712faec5eeebce6baaee8b13617faba26b3b358921950160ad50f9a09d9e58b7
Instruction Fuzzy Hash: D5B15974E0424CEFDB11DF99D880BBE7BB1AF56304F14415AE6049B3A2C778AD42CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004EAC03 Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 004EAD8B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004EADA7
__allrem.LIBCMT ref: 004EADBE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004EADDC
__allrem.LIBCMT ref: 004EADF3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004EAE11

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 71c8420f77c3c6b4205cd649fa68cc37f68444db08f8c9dfdfe450398f673b61
Instruction ID: 1b3fea5176a95fd5fcec1025af7aaf911d8005413d807e00b03de1864a21ce91
Opcode Fuzzy Hash: 71c8420f77c3c6b4205cd649fa68cc37f68444db08f8c9dfdfe450398f673b61
Instruction Fuzzy Hash: E9811672A00B469BD7209B2FCC41B6B73E9AF40366F24462FF511C6381E778ED10879A

Uniqueness

Uniqueness Score: -1.00%

Function 0041D560 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 244libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041D79A
GetProcAddress.KERNEL32(00000000,06150005), ref: 0041D7A5
WSASend.WS2_32(0000000F,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0041D7BA

Strings

Ws2_32.dll, xrefs: 0041D791
39<, xrefs: 0041D774

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcSend
String ID: 39<$Ws2_32.dll
API String ID: 2819740048-4200987404
Opcode ID: c69c04ee7ae2295ddacff926e2ae81a183a2070aca705dce49a36a733aacb347
Instruction ID: 51d12b58568d2725e11e2f3ede4e953a1ffade967b8a63a07fe4bd30ab4072ec
Opcode Fuzzy Hash: c69c04ee7ae2295ddacff926e2ae81a183a2070aca705dce49a36a733aacb347
Instruction Fuzzy Hash: C7A179B0E00214DFCB24DF58C9447AEBBF0AF18714F18855EE869AB381D779AD81CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00414233 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 192fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 00414337
std::_Throw_Cpp_error.LIBCPMT ref: 00414482
std::_Throw_Cpp_error.LIBCPMT ref: 00414493

Strings

\, xrefs: 00414253

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$CopyFile
String ID: \
API String ID: 4177132511-2967466578
Opcode ID: d2dbee1534c5c85b3556dab985fa2ee1985f678c8ffbde03522007a8a5baf56b
Instruction ID: ec448d641316e2a3872437f4d92d0186c9a642a8506e38dff8007fdda78d9240
Opcode Fuzzy Hash: d2dbee1534c5c85b3556dab985fa2ee1985f678c8ffbde03522007a8a5baf56b
Instruction Fuzzy Hash: 8681FC70D00288DFDF04DBE4D945BEDBBB4EF15308F20429EE41067292EBB81A48DB96

Uniqueness

Uniqueness Score: -1.00%

Function 004F4C09 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(dN,?,004E64E1,?,?,?,00000000), ref: 004F4C11
GetLastError.KERNEL32(?,004E64E1,?,?,?,00000000), ref: 004F4C1B
__dosmaperr.LIBCMT ref: 004F4C22

Strings

dN, xrefs: 004F4C0E

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID: dN
API String ID: 1545401867-1959024296
Opcode ID: 5dc75ce04c15e295acdd42d31dd70232daf278466f7767e5e62d7905f0952de2
Instruction ID: 75627c7e57507863508bb374b15be04f9f819f00b988c6ee8400558b9e74fa4a
Opcode Fuzzy Hash: 5dc75ce04c15e295acdd42d31dd70232daf278466f7767e5e62d7905f0952de2
Instruction Fuzzy Hash: A3D02232000508FB8B002BF2BC0C8573B1CDFD03393100A23F42CC05A0EE35C891A250

Uniqueness

Uniqueness Score: -1.00%

Function 00491300 Relevance: 6.1, APIs: 4, Instructions: 66fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 0049131F
GetLastError.KERNEL32 ref: 0049132A
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00491352
GetLastError.KERNEL32 ref: 0049135C

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLast$PointerRead
String ID:
API String ID: 2170121939-0
Opcode ID: fc66bafa82d2f8404cdf7c252faac411a51537015cb655470ecd5fc5aba69e13
Instruction ID: 0b9ab4fa7100161e3312e7656db52f40096a583a722d5ee13f2c0e10fa81db1a
Opcode Fuzzy Hash: fc66bafa82d2f8404cdf7c252faac411a51537015cb655470ecd5fc5aba69e13
Instruction Fuzzy Hash: EA114632600509EBDB108FA9EC05BDABBA8EF55371F008267FD1CC6660E775D9609BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0041EBA0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 267fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AC70: __fread_nolock.LIBCMT ref: 0040AD44

DeleteFileA.KERNELBASE(?), ref: 0041EC07

Strings

3, xrefs: 0041EE37
cad, xrefs: 0041ED91, 0041EDB4

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: DeleteFile__fread_nolock
String ID: 3$cad
API String ID: 3901365830-1935378428
Opcode ID: f7301a40b307fd71562f9030343ef306315756893d55ed6466546a7cfe9cdc3f
Instruction ID: 62bbc81b036fc7eec248f0632e251a3009aed052e2521f9a115e3063f2f9f842
Opcode Fuzzy Hash: f7301a40b307fd71562f9030343ef306315756893d55ed6466546a7cfe9cdc3f
Instruction Fuzzy Hash: CCB1BE74E00249DFCB00DF65C804BEEBBB1AF45308F24819AE505AB382D779AE45DBD5

Uniqueness

Uniqueness Score: -1.00%

Function 004F293D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004F2053: GetConsoleOutputCP.KERNEL32(E745BA98,00000000,00000000,?), ref: 004F20B6

WriteFile.KERNELBASE(?,00000000,004E6777,?,00000000,00000000,00000000,?,00000000,?,00000000,wgN,00000000,00000000,?,?), ref: 004F2AC2
GetLastError.KERNEL32(?,004E6777,00000000,?,00000000,?,00000000,00000000), ref: 004F2ACC

Strings

wgN, xrefs: 004F293F

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID: wgN
API String ID: 2915228174-354891312
Opcode ID: c4e0fab56aaa5aa668606d57f16693d2fff82ef8988b3cb834d35c0f5d62a876
Instruction ID: 58ddb85c8bea4c2b3dbe3e5c994e5fd3db19d053895fb78a9c91e10694f9601d
Opcode Fuzzy Hash: c4e0fab56aaa5aa668606d57f16693d2fff82ef8988b3cb834d35c0f5d62a876
Instruction Fuzzy Hash: BB61A271D0011EAFDF11CFA8CA84EFEBBB9AF19304F14014AEA00A7255D3B9D906CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004060E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 004DE42B: RaiseException.KERNEL32(E06D7363,00000001,00000003,0045DCD0,0045DCD0,?,?,004DAF37,0045DCD0,0053D744,00000000,0045DCD0,00000000,00000001), ref: 004DE48B

___std_fs_directory_iterator_open@12.LIBCPMT ref: 004061E8
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406202

Strings

absolute, xrefs: 00406116

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID: absolute
API String ID: 1297148070-2799662678
Opcode ID: 83d60d2f71de9d8f69fa5d81af5cafba3f0471d6c422f5ef9654ebbd380b6de7
Instruction ID: df52e70302dbc25e70dbc729ec55d43ed626788b5323ae355475d9aa96fec0df
Opcode Fuzzy Hash: 83d60d2f71de9d8f69fa5d81af5cafba3f0471d6c422f5ef9654ebbd380b6de7
Instruction Fuzzy Hash: 9831D071900618ABCB20EF55C945AAFBBB8FF44764F00066AE815773C1DB38AA04CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0040AC3C

Strings

qZC, xrefs: 0040AC50
1, xrefs: 0040ABA5

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID: 1$qZC
API String ID: 2638373210-4291668569
Opcode ID: e6e22c07389a48e61ae8e95e7b83de7e9b3121829484d644dc2acc3f52427005
Instruction ID: d341f4343d4f5fdecf0593ce2782d3c7c06861483f708230bb127ce9c5082770
Opcode Fuzzy Hash: e6e22c07389a48e61ae8e95e7b83de7e9b3121829484d644dc2acc3f52427005
Instruction Fuzzy Hash: 0B31C1709043459BDB20EF69C905BAFBBF4EF44704F10066EE5416B282D7B99A48CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0040B270 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00000005,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B2B5

Part of subcall function 004DBDDA: ReleaseSRWLockExclusive.KERNEL32(?,DT,0040B6FD,005444E8,?,?,\*.*,00000004), ref: 004DBDEE

std::_Throw_Cpp_error.LIBCPMT ref: 0040B2E4
std::_Throw_Cpp_error.LIBCPMT ref: 0040B2F5

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryExclusiveLockRelease
String ID:
API String ID: 1881651058-0
Opcode ID: 4aa31760ff55f9e8091e016fbf5db6d1ac4fd96c015ccc68c759aad941cf529b
Instruction ID: 2083917a30228ff47c2f58c55b42abb2321d0377fce0ac6287103c5d37e315ef
Opcode Fuzzy Hash: 4aa31760ff55f9e8091e016fbf5db6d1ac4fd96c015ccc68c759aad941cf529b
Instruction Fuzzy Hash: E0F086B5980704EBDB209B5A9D06B9A7A98E702B38F11436FF435533D0E7755A00CAEA

Uniqueness

Uniqueness Score: -1.00%

Function 004EC819 Relevance: 4.5, APIs: 3, Instructions: 15COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,004EC813,?,004E1C93,?,?,E745BA98,004E1C93,?), ref: 004EC82A
TerminateProcess.KERNEL32(00000000,?,004EC813,?,004E1C93,?,?,E745BA98,004E1C93,?), ref: 004EC831
ExitProcess.KERNEL32 ref: 004EC843

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 570eabad1b53be2d073ee1c841cabbe5f8cdf0a80e41f99a4d5a77ab8836c315
Instruction ID: 441ef718a996dc58b5bae7a476c47dbc26188b301f5d8cdfa8241a9a43c48a8d
Opcode Fuzzy Hash: 570eabad1b53be2d073ee1c841cabbe5f8cdf0a80e41f99a4d5a77ab8836c315
Instruction Fuzzy Hash: AED05E32000544FBCF013F62DE4D8993F29BFA0347B448025B86549131DB79895AEA84

Uniqueness

Uniqueness Score: -1.00%

Function 0043E990 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0043E9E1

Strings

"6, xrefs: 0043EB5F

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: "6
API String ID: 1514166925-701612358
Opcode ID: 449d5c4dad14d35fcf056e8945d132f492ee13bef44607acf26823712170881c
Instruction ID: 7f6c3857031e9ecd41295e242b3f508b67c493e0e27127d8f4aabd3770d547c9
Opcode Fuzzy Hash: 449d5c4dad14d35fcf056e8945d132f492ee13bef44607acf26823712170881c
Instruction Fuzzy Hash: 09512970C04298CAEB15DF64C948BEDB770BF16304F1082DDD4896B2C2DBB51A89CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0040AE5B

Strings

1, xrefs: 0040ADC8

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID: 1
API String ID: 2638373210-2239968871
Opcode ID: 2f17ea8987909e3e989814b92dc302369c34d617860f511247742bdef80ca715
Instruction ID: cd64ae41dfe00b5b06abe2499f886eb89be18efc885343d0108f39dd319ff50a
Opcode Fuzzy Hash: 2f17ea8987909e3e989814b92dc302369c34d617860f511247742bdef80ca715
Instruction Fuzzy Hash: B231F570900344ABDB14EF6AC945B9F7BA8EF44718F10016EF505AB2C2D7B99A41CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0040AD44

Strings

1, xrefs: 0040ACB5

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID: 1
API String ID: 2638373210-2239968871
Opcode ID: 2726fe02627068cd5e911be42c1f5965b664eb0a47088c450a8276a39c1ac5fd
Instruction ID: 7c3e4a2e44c553cc6198f079d267962b1fbb4f5559f4fdaaaa07a3eeae676227
Opcode Fuzzy Hash: 2726fe02627068cd5e911be42c1f5965b664eb0a47088c450a8276a39c1ac5fd
Instruction Fuzzy Hash: 1031F470900244ABDB14EF69D945B9F7BA8FF44748F10056EF405AB2C2D7BD8A01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004F3893 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,hN,?,?,004F3219,00000001,00000364,?,00000008,000000FF,?,00000000,004EA934,004E60B3,004E68E7), ref: 004F38D4

Strings

hN, xrefs: 004F38AC, 004F38A7, 004F38C0, 004F38CB

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: hN
API String ID: 1279760036-3631290788
Opcode ID: 4b738e08c8238f13c158b6f4aebdfc83a859e181ea2e4dc4c4678612e856ec98
Instruction ID: e138f4603294848592488f8e504d332de797348aa899f191c1844a830e0ba78f
Opcode Fuzzy Hash: 4b738e08c8238f13c158b6f4aebdfc83a859e181ea2e4dc4c4678612e856ec98
Instruction Fuzzy Hash: 95F0BB3110052C67DB217F63DC05BBB37D89F517E2B154027BE08D6151CB3CD94556E9

Uniqueness

Uniqueness Score: -1.00%

Function 004144E0 Relevance: 3.1, APIs: 2, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00414675
std::_Throw_Cpp_error.LIBCPMT ref: 00414686

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: ac862eee7d6d7ce6c3a12efbee1ba40941964af439277532c0956238cae26ce1
Instruction ID: d0c1233a766ed38641b4c07237d350fd222a008ab52e14fa55b74dcab28789ba
Opcode Fuzzy Hash: ac862eee7d6d7ce6c3a12efbee1ba40941964af439277532c0956238cae26ce1
Instruction Fuzzy Hash: BB411375E00205CBCB24DF6CD8017AEB7B2FB91708F05062EE815A7392DB78A984DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00406150 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 004061E8
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406202

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID:
API String ID: 3016148460-0
Opcode ID: 199b10b5cbcfc3bac638bdf402b44041a05770ed40428cdac618f3dde5b17595
Instruction ID: d4caf346f189b166542986bb95bd81797666f76ba9d979eef76578570dd901e2
Opcode Fuzzy Hash: 199b10b5cbcfc3bac638bdf402b44041a05770ed40428cdac618f3dde5b17595
Instruction Fuzzy Hash: 1D31D072A00618ABCB24EF49D851BAEB7B4EF84764F01066FEC1663780DB396D14CAD4

Uniqueness

Uniqueness Score: -1.00%

Function 004F4253 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,004FAD87,004E60B3,00000000,004E60B3,?,004FB028,004E60B3,00000007,004E60B3,?,004FB51C,004E60B3,004E60B3), ref: 004F4269
GetLastError.KERNEL32(004E60B3,?,004FAD87,004E60B3,00000000,004E60B3,?,004FB028,004E60B3,00000007,004E60B3,?,004FB51C,004E60B3,004E60B3), ref: 004F4274

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8b73b785357b2346bfa9b41464cc3ad5fe5b38bc98d19c64144e2217278180d9
Instruction ID: ea2134de0cf5f8181c31f49d7920a3ecd8334c799a4adc26afd63096a676bfd3
Opcode Fuzzy Hash: 8b73b785357b2346bfa9b41464cc3ad5fe5b38bc98d19c64144e2217278180d9
Instruction Fuzzy Hash: 62E08632100614A7CB112BA5AC0C7DE3F98AF80395F028476F60C86160EA3898649798

Uniqueness

Uniqueness Score: -1.00%

Function 00473140 Relevance: 1.7, APIs: 1, Instructions: 162COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004732BF

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: abf0348b899f8cd4233dfb6fdb067882a70edd61fb843c06ee3e014df0a97aed
Instruction ID: aa5b3fa2fee637667061d727e0b6404d379ff605ea095809ed05f8f8f5eeafac
Opcode Fuzzy Hash: abf0348b899f8cd4233dfb6fdb067882a70edd61fb843c06ee3e014df0a97aed
Instruction Fuzzy Hash: 3851A471E001159FCB08DF69C941AEEB7F5AF98300F14816EE809E7396EB38DE058795

Uniqueness

Uniqueness Score: -1.00%

Function 004E2032 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca496ef47f0e7f3bd31ff4d0c6dd67ba7ae3da1b984ba6e74bea7cea9b832298
Instruction ID: a945f24e44b28e743e936d21751d2e95920c4c00ec505ba9b30c130e86fbcea3
Opcode Fuzzy Hash: ca496ef47f0e7f3bd31ff4d0c6dd67ba7ae3da1b984ba6e74bea7cea9b832298
Instruction Fuzzy Hash: 6151F670A00284AFDF14CF5ACD81AAABFB5EF45315F24815AF9085B352C3B5DE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004F4C31 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004F42CD: RtlAllocateHeap.NTDLL(00000000,004F9713,4D88C033,?,004F9713,00000220,?,004F2C8F,4D88C033), ref: 004F42FF

RtlReAllocateHeap.NTDLL(00000000,00000000,?,004EF921,00000000,?,004FA453,00000000,004EF921,00000012,00000001,?,?,004EF71B,00000001,00000012), ref: 004F4C8E

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2e7b996dfa0404416d11db56eea4719c29d833f3cb97030e177712381e300773
Instruction ID: c197068544b6a74edd42beafa1091b609f8eeec5afa400caf0f2e88d1c1e41a9
Opcode Fuzzy Hash: 2e7b996dfa0404416d11db56eea4719c29d833f3cb97030e177712381e300773
Instruction Fuzzy Hash: BBF0FC3610219DA6C7212A23AC04F7F37589FC2775B17512BFB28962A1EF3CC80155AD

Uniqueness

Uniqueness Score: -1.00%

Function 004F42CD Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,004F9713,4D88C033,?,004F9713,00000220,?,004F2C8F,4D88C033), ref: 004F42FF

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2198638593cbac858731316a311480fbe239b50477190752b525c17ad8c2d171
Instruction ID: 89252cde3629954a7dd651662e79814aadfa885b8aeb937b2ffe9774318fd193
Opcode Fuzzy Hash: 2198638593cbac858731316a311480fbe239b50477190752b525c17ad8c2d171
Instruction Fuzzy Hash: 23E0A02530421896D63126AA9C04BBB3A489BC23B8F160167BF0596291DF2CCC0181FE

Uniqueness

Uniqueness Score: -1.00%

Function 004EF889 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004EF890

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 642ab808bc47696ae728f0514146959be3b190675648a466094860987fb1a248
Instruction ID: 6774f2ffb1e86b77a5a3f95ea0b65f3d51a0f57c6d64d54c353970c0c04ae7a7
Opcode Fuzzy Hash: 642ab808bc47696ae728f0514146959be3b190675648a466094860987fb1a248
Instruction Fuzzy Hash: 66E09AB6C0020DAADB00DFD5C452BEFBBFCAB08304F50412BA205E7141EA7857858BE1

Uniqueness

Uniqueness Score: -1.00%

Function 004EBBBC Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000), ref: 004EBBD9

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5bacf90617f034da2893445faaeab56ee3b919b783a427b181f714fcfbce91ee
Instruction ID: 68ba10a0c8402e923ab1748f6cde1fcb114169dd3f62df60daf3c7347e77fc85
Opcode Fuzzy Hash: 5bacf90617f034da2893445faaeab56ee3b919b783a427b181f714fcfbce91ee
Instruction Fuzzy Hash: 68D06C3205010DFBDF028F84DC06EDA3BAAFB88714F018000BA5856120C732E821EB90

Uniqueness

Uniqueness Score: -1.00%

Function 0043CA61 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(6C2E0000), ref: 0043CA73

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 1b817b431e1bcb8b8660f8d52eba7c158e344ec8198f08c13cc3c16a208e3d83
Instruction ID: c2aff94c4f18faa8c51ba634006d0e3fc72a7f72d38d24f3f513cb8b6753d3b2
Opcode Fuzzy Hash: 1b817b431e1bcb8b8660f8d52eba7c158e344ec8198f08c13cc3c16a208e3d83
Instruction Fuzzy Hash: 9EC0805844C7C19BD70283704C0C3DEFF547B37308F8800879544D5196F27CC018D611

Uniqueness

Uniqueness Score: -1.00%

Function 0041E890 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041E907

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6ae5d539560427b4273ddbb2323bd143869bb8717069fdd20952c7c124a300a7
Instruction ID: 856fd3f3b6c9bdd6e77d2204c72a8a86155eda9e7d346db51e80ac84defc7b96
Opcode Fuzzy Hash: 6ae5d539560427b4273ddbb2323bd143869bb8717069fdd20952c7c124a300a7
Instruction Fuzzy Hash: D00120B6E44684ABD720EB599C0ABAE7B54E741B28F14024EF5141B3C1D7791844D7C6

Uniqueness

Uniqueness Score: -1.00%

Function 0041E930 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000065,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041E9A7

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1dd3132a831f6b3fdc37602cddac998eaa2dfe8dc3bc418b2e161be17c3cae3a
Instruction ID: 4d51e3cdc561a834d510c8c3ef11e1b4b22122f6eac1103c18ef6d6a89a62e8d
Opcode Fuzzy Hash: 1dd3132a831f6b3fdc37602cddac998eaa2dfe8dc3bc418b2e161be17c3cae3a
Instruction Fuzzy Hash: 310120B6E54644ABD7209B599C06BEE7B64E741B28F14024EF5181B3C1D77818448BC5

Uniqueness

Uniqueness Score: -1.00%

Function 0041E9D0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000065,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041EA47

Memory Dump Source

Source File: 00000000.00000002.2079541618.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d6de9ebc316f42d030ed6e88b55143bd222477d6e94bd323caeb6c642de71256
Instruction ID: 8197e4f2a7925b8cf845a2034c93b7373f5ae7c38e82d9b16ca3c881090597ec
Opcode Fuzzy Hash: d6de9ebc316f42d030ed6e88b55143bd222477d6e94bd323caeb6c642de71256
Instruction Fuzzy Hash: 22017B75E44784AFD710EB49DC06BAEBBA4EB51B28F04024EF5241B7C1D7B8184487C5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_236d6df2-efc0-4d22-90e1-905525e0d691\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_27e5690c-112c-4d22-9e99-8c6f0b14382c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_5bbc99b4-587d-40fe-ac59-0cbe63303745\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_5efb3555-bb77-4635-b3c4-88d10f7fc557\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_65d98138-d915-4355-b808-11207aa2a205\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_71a1c664-e693-463e-9310-d4cb42099473\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_7cf8ce8f-1aed-4201-8a63-0b00abb7edea\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_868d590d-f3fc-44f0-b341-e996dca8898b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_8e82ae91-098c-43c8-af98-78b98945d2fd\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_9107bfeb-e283-447b-b7fc-1a197446dc21\Report.wer

Windows Analysis Report
file.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre