Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\ProgramData\MPGPH131\MPGPH131.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\HZqMYfpyMfdfHfQja15Vpq6.zip

Zip archive data, at least v2.0 to extract, compression method=deflate

modified

C:\Users\user\AppData\Local\Temp\ax62Lo_zBXq90uwBqgwbr3X.zip

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Local\Temp\rTXApvaKL9yw6N5oqHITZ9U.zip

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_236d6df2-efc0-4d22-90e1-905525e0d691\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_27e5690c-112c-4d22-9e99-8c6f0b14382c\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_5bbc99b4-587d-40fe-ac59-0cbe63303745\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_5efb3555-bb77-4635-b3c4-88d10f7fc557\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_65d98138-d915-4355-b808-11207aa2a205\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_71a1c664-e693-463e-9310-d4cb42099473\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_7cf8ce8f-1aed-4201-8a63-0b00abb7edea\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_868d590d-f3fc-44f0-b341-e996dca8898b\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_8e82ae91-098c-43c8-af98-78b98945d2fd\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_76a8b624aa1c3f63e51b8c46f4549fe453f20_664b7b5e_9107bfeb-e283-447b-b7fc-1a197446dc21\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_26e483d4-fbd0-4cc6-b45d-6b9e29e77863\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_30d4bf65-0144-4d41-a1e5-2d1f034d6932\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_30f7c2e0-e953-4274-809a-130ac21e06ea\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_350cc484-f125-4e6a-a9b7-37b821553dcf\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_51c1b91c-177b-4c73-b33d-0ffa0a872ffd\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_a77f59a8-8b59-4992-86c8-63a5f0627f3c\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_abb99b7dbfb2236439a53546d25fcd4b72b99ec0_b211229c_daed0f05-904b-4a99-8e36-6a836ebbd0ab\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER134.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:11 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A0.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4DF.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC7.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1D7.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:04:59 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2C2.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2F2.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA91.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:01 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB1F.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB3F.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC95.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:01 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD03.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD23.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF06.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:02 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF74.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDFA4.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1A6.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:03 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE281.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2B1.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE3B9.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:03 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4B4.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4F3.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE511.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:03 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5DD.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5FD.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9A4.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:05 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA42.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA62.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERECD1.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:05 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERED6E.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDAE.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5BA.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:08 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF637.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:08 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF6A6.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF6D4.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF7.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF704.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF714.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF935.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:09 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF964.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:09 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFABC.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFADD.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB1A.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB5A.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFCDE.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:10 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD6C.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD8C.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFDD8.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:10 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE95.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFEC5.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFEC.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Apr 20 18:05:10 2024, 0x1205a4 type

dropped

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\adobejdT_84zuiGXP\Cookies\Chrome_Default.txt

ASCII text, with very long lines (769), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\adobejdT_84zuiGXP\information.txt

ASCII text, with CRLF, LF line terminators

dropped

C:\Users\user\AppData\Local\Temp\adobejdT_84zuiGXP\passwords.txt

Unicode text, UTF-8 text, with CRLF, LF line terminators

dropped

C:\Users\user\AppData\Local\Temp\adobepjTpZimyl6qo\Cookies\Chrome_Default.txt

ASCII text, with very long lines (769), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\adobepjTpZimyl6qo\information.txt

ASCII text, with CRLF, LF line terminators

dropped

C:\Users\user\AppData\Local\Temp\adobepjTpZimyl6qo\passwords.txt

Unicode text, UTF-8 text, with CRLF, LF line terminators

dropped

C:\Users\user\AppData\Local\Temp\adobezQtRch0ZmSou\Cookies\Chrome_Default.txt

ASCII text, with very long lines (769), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\adobezQtRch0ZmSou\information.txt

ASCII text, with CRLF, LF line terminators

dropped

C:\Users\user\AppData\Local\Temp\adobezQtRch0ZmSou\passwords.txt

Unicode text, UTF-8 text, with CRLF, LF line terminators

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\02zdBXl47cvzcookies.sqlite

SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\1FcP9eUeV0_qWeb Data

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\3b6N2Xdh3CYwplaces.sqlite

SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\79XSsViDXoczHistory

SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\8MhogtJMRILwHistory

SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\D87fZN3R3jFeplaces.sqlite

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\IO6Zwb2pZcpALogin Data For Account

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\IXC06WTABbSzCookies

SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\Sbg9DSp7lstNHistory

SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\W5ItwnbOEWbrLogin Data

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\ZAfgfBvVuQKNWeb Data

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\iTUZG7291Qb8Web Data

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\p5yNjy0gJTQpWeb Data

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\s_jDytUw5zVDWeb Data

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\thdijlfvXXi5History

SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\trdFrTbEn6pPLogin Data

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\heidijdT_84zuiGXP\w6NCEqkWwTcAWeb Data

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\02zdBXl47cvzcookies.sqlite

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\14vKYSMfhshSLogin Data

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\3b6N2Xdh3CYwplaces.sqlite

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\6GKpONOgQCQDWeb Data

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\7CSy0IxQh1VlHistory

SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\CEYAAajxdr9QLogin Data

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\D87fZN3R3jFeplaces.sqlite

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\MBYfBCnDVQSSHistory

SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\amggfY1X012lWeb Data

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\fzOGBVhWIKhlHistory

SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\gyqRvWXIZE5OWeb Data

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\iaBWdi4Fnhz1Web Data

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\njJisi0cnX_KWeb Data

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\rdVUsVkL4QbQWeb Data

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\sANT26gQMwt7History

SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\sWrnFSWiPcWWCookies

SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11

dropped

C:\Users\user\AppData\Local\Temp\heidipjTpZimyl6qo\tTQUAdIiirY8Login Data For Account

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\02zdBXl47cvzcookies.sqlite

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\1xsvu65yyJa4Login Data For Account

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\3b6N2Xdh3CYwplaces.sqlite

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\8HRycHnVbK4iWeb Data

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\8ZJZxxoSigJTHistory

SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\Bu4fqjuvymtRLogin Data

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\D87fZN3R3jFeplaces.sqlite

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\Gf8hzmQcfGHfWeb Data

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\JDpwntiCRWhZWeb Data

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\Lk65jVXnM3gHWeb Data

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\TuqMWxaa7e_CCookies

SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\YbzjBYrL0NXcHistory

SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\Z2XBcxuCaxhxHistory

SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\bPe6T3UEPwG2Login Data

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\rdNYuR1GWMoBWeb Data

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\uUNSZzd9cNCaHistory

SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4

dropped

C:\Users\user\AppData\Local\Temp\heidizQtRch0ZmSou\zgOZJSvD4T6RWeb Data

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

ASCII text, with no line terminators

dropped

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

There are 128 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 848

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 972

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 776

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 1396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 888

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 908

There are 14 hidden processes, click here to show them.

URLs

Name

Malicious

http://193.233.132.167/cost/lenin.exe

unknown

https://db-ip.com/demo/home.php?s=81.181.57.52o

unknown

https://duckduckgo.com/chrome_newtab

unknown

https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF

unknown

https://db-ip.com/demo/home.php?s=81.181.57.52l

unknown

https://duckduckgo.com/ac/?q=

unknown

https://t.me/RiseProSUPPORTs

unknown

http://147.45.47.102:57893/hera/amadka.exe

unknown

https://db-ip.com/

unknown

https://ipinfo.io/widget/demo/81.181.57.52u

unknown

http://147.45.47.102:57893/hera/amadka.exe68.0

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

https://db-ip.com/0

unknown

https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17

unknown

https://t.me/RiseProSUPPORTa

unknown

http://193.233.132.167/cost/go.exe

unknown

https://ipinfo.io/widget/demo/81.181.57.52b

unknown

https://db-ip.com:443/demo/home.php?s=81.181.57.52d

unknown

https://ipinfo.io:443/widget/demo/81.181.57.52

unknown

https://ipinfo.io/widget/demo/81.181.57.52ey

unknown

https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

https://t.me/risepro_botisepro_bot

unknown

http://193.233.132.167/cost/go.exeIdser

unknown

http://193.233.132.167/cost/lenin.exe81.57.52

unknown

https://db-ip.com:443/demo/home.php?s=81.181.57.52

unknown

http://193.233.132.167/cost/lenin.exeUser

unknown

https://www.google.com/images/branding/product/ico/googleg_lodp.ico

unknown

https://ipinfo.io/M2_&

unknown

https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://147.45.47.102:57893/hera/amadka.exef

unknown

http://upx.sf.net

unknown

https://t.me/RiseProSUPPORT

unknown

https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016

unknown

http://193.233.132.167/cost/go.exeomanialisherQ

unknown

https://www.ecosia.org/newtab/

unknown

https://ipinfo.io/Mozilla/5.0

unknown

https://ipinfo.io/widget/demo/81.181.57.52

34.117.186.192

https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br

unknown

https://t.me/RiseProSUPPORT0o

unknown

https://ac.ecosia.org/autocomplete?q=

unknown

https://t.me/risepro_bot

unknown

http://193.233.132.167/cost/lenin.exe.exeData.

unknown

https://t.S

unknown

https://db-ip.com/demo/home.php?s=81.181.57.52u_

unknown

https://ipinfo.io/

unknown

https://t.me/risepro_both

unknown

https://db-ip.com/demo/home.php?s=81.181.57.52

104.26.4.15

http://193.233.132.167/cost/go.exelater

unknown

https://www.maxmind.com/en/locate-my-ip-address

unknown

https://ipinfo.io/=R

unknown

http://www.winimage.com/zLibDll

unknown

http://193.233.132.167/cost/go.exeoin7FwmBKlOFG

unknown

https://support.mozilla.org

unknown

https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples

unknown

http://193.233.132.167/cost/lenin.exeerty.jaxx

unknown

https://t.me/risepro_botlaterT

unknown

http://193.233.132.167/cost/lenin.exeania

unknown

https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=

unknown

https://t.me/RiseProSUPPORT~

unknown

http://193.233.132.167/cost/go.exe/

unknown

http://www.winimage.com/zLibDllDpRTpR

unknown

https://t.me/risepro_botriseproon1

unknown

There are 54 hidden URLs, click here to show them.

Domains

Name

Malicious

ipinfo.io

34.117.186.192

Details

Name:	ipinfo.io
IP:	34.117.186.192
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

db-ip.com

104.26.4.15

Details

Name:	db-ip.com
IP:	104.26.4.15
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

147.45.47.93

unknown

Russian Federation

Details

IP:	147.45.47.93
TargetID:	0
Current Path:	C:\Users\user\Desktop\file.exe
Country:	Russian Federation
Countrycode:	RUS
ASN number:	2895
ASN name:	FREE-NET-ASFREEnetEU
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Connects to many ports of the same IP (likely port scanning)	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

34.117.186.192

ipinfo.io

United States

Details

IP:	34.117.186.192
TargetID:	0
Current Path:	C:\Users\user\Desktop\file.exe
Country:	United States
Countrycode:	USA
ASN number:	139070
ASN name:	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG
Private:	false
Domain:	ipinfo.io

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

104.26.4.15

db-ip.com

United States

Details

IP:	104.26.4.15
TargetID:	0
Current Path:	C:\Users\user\Desktop\file.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	db-ip.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

RageMP131