Edit tour

Windows Analysis Report
ygm2mXUReY.exe

Overview

General Information

Sample name:	ygm2mXUReY.exe renamed because original name is a hash value
Original sample name:	d668244429e4a7a0b205b2ce843b9663.exe
Analysis ID:	1429359
MD5:	d668244429e4a7a0b205b2ce843b9663
SHA1:	dd8aee62f445db5649840f9ffb8cb33d304254f3
SHA256:	ef09750219f549d293572aedb0f593ef6c4a74ac77bb99950ca8b5a91377ab89
Tags:	32exetrojan
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

Connects to many ports of the same IP (likely port scanning)

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

ygm2mXUReY.exe (PID: 5504 cmdline: "C:\Users\user\Desktop\ygm2mXUReY.exe" MD5: D668244429E4A7A0B205B2CE843B9663)

schtasks.exe (PID: 6520 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4712 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 2656 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 796 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4128 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 952 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6224 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 984 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5044 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 992 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1476 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 1056 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6624 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 1380 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3140 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 1388 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 1672 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: D668244429E4A7A0B205B2CE843B9663)

WerFault.exe (PID: 6204 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 800 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2656 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 912 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3184 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 916 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6508 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 948 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 736 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: D668244429E4A7A0B205B2CE843B9663)

WerFault.exe (PID: 2924 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 772 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6292 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 896 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6580 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 900 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5960 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 912 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5496 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1100 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\SZDEAvOWuc1j5blWLO4H6aA.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\dxTuy4jPkMDKvqGzbwvO8nc.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2415576693.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000003.2440628791.0000000004371000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000002.2607924286.0000000005F30000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000A.00000003.2439521788.0000000008E04000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2413162518.000000000427D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.2607833266.00000000046C3000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2413282182.000000000435E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2590308249.0000000004656000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.2608848110.0000000008E08000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2590418032.0000000005FE0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2414862397.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: ygm2mXUReY.exe PID: 5504	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: ygm2mXUReY.exe PID: 5504	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 1672	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 1672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 736	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 17 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\ygm2mXUReY.exe, ProcessId: 5504, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/22/24-01:53:01.193897
SID:	2046266
Source Port:	58709
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/22/24-01:53:38.322767
SID:	2046269
Source Port:	49708
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/22/24-01:53:37.276261
SID:	2046269
Source Port:	49706
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/22/24-01:53:24.660719
SID:	2046266
Source Port:	58709
Destination Port:	49723
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/22/24-01:53:00.837713
SID:	2046266
Source Port:	58709
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/22/24-01:53:24.890079
SID:	2046267
Source Port:	58709
Destination Port:	49723
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Exfiltration) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/22/24-01:53:54.436720
SID:	2046270
Source Port:	49723
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/22/24-01:52:56.197489
SID:	2049060
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro CnC Activity (Inbound) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/22/24-01:53:54.436720
SID:	2049661
Source Port:	49723
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/22/24-01:53:29.479123
SID:	2046269
Source Port:	49723
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/22/24-01:52:56.636815
SID:	2046267
Source Port:	58709
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/22/24-01:52:56.389699
SID:	2046266
Source Port:	58709
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/22/24-01:53:47.973422
SID:	2046269
Source Port:	49715
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/22/24-01:53:01.078051
SID:	2046267
Source Port:	58709
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/22/24-01:53:00.350421
SID:	2046269
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/22/24-01:53:12.584543
SID:	2046266
Source Port:	58709
Destination Port:	49715
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ygm2mXUReY.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://193.233.132.167/cost/lenin.exe

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Avira: detection malicious, Label: HEUR/AGEN.1313019

Multi AV Scanner detection for domain / URL

Source: http://193.233.132.167/cost/lenin.exeepro	Virustotal: Detection: 24%	Perma Link
Source: http://193.233.132.167/cost/go.exe	Virustotal: Detection: 24%	Perma Link
Source: http://193.233.132.167/cost/go.exeadka.ex	Virustotal: Detection: 24%	Perma Link
Source: http://193.233.132.167/cost/lenin.exe0	Virustotal: Detection: 23%	Perma Link
Source: http://147.45.47.102:57893/hera/amadka.exe	Virustotal: Detection: 18%	Perma Link
Source: http://147.45.47.102:57893/hera/amadka.exea	Virustotal: Detection: 15%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 36%
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Virustotal: Detection: 39%	Perma Link
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Virustotal: Detection: 39%	Perma Link

Multi AV Scanner detection for submitted file

Source: ygm2mXUReY.exe

Virustotal: Detection: 39%

Perma Link

Machine Learning detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ygm2mXUReY.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Code function: 0_2_004D1240 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,

0_2_004D1240

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Unpacked PE file: 0.2.ygm2mXUReY.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 10.2.MPGPH131.exe.400000.0.unpack

Source: ygm2mXUReY.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49725 version: TLS 1.2

Source:	Binary string: ]C:\wedigi\reciforeb\tetuguhuc\y.pdb source: ygm2mXUReY.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr
Source:	Binary string: C:\wedigi\reciforeb\tetuguhuc\y.pdb source: ygm2mXUReY.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_004D0620 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004D0620
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_004F2870 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004F2870
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0042C82B FindClose,FindFirstFileExW,GetLastError,	0_2_0042C82B

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ygm2mXUReY.exe_65396d3389e0d0bfd23059c0a7ad776d4579bbf9_66eab1d0_2bf57861-c4ef-4b8b-97e9-ae95bb3c92d5\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_782df4d4-a9ed-4ef0-9c2b-b94a67192a7b\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.5:49705 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49705
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.5:49705
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49705 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49706
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.5:49706
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49708
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49706 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49708 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49715
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49715 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49723
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.5:49723
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49723 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2049661 ET TROJAN RisePro CnC Activity (Inbound) 192.168.2.5:49723 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046270 ET TROJAN [ANY.RUN] RisePro TCP (Exfiltration) 192.168.2.5:49723 -> 147.45.47.93:58709

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 147.45.47.93:58709

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 147.45.47.93 147.45.47.93
Source: Joe Sandbox View	IP Address: 172.67.75.166 172.67.75.166

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Code function: 0_2_004D3150 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,freeaddrinfo,WSACleanup,freeaddrinfo,

0_2_004D3150

Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown

DNS traffic detected: queries for: ipinfo.io

Source: ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377717823.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377717823.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe&
Source: MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeA
Source: MPGPH131.exe, 00000009.00000003.2442056915.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.0000000004371000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exea
Source: ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe.52
Source: MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exeadka.ex
Source: MPGPH131.exe, 00000009.00000003.2442056915.0000000004371000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exeate
Source: ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exeda1t
Source: ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe
Source: MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe0
Source: MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exeepro
Source: ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exeoina
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: ygm2mXUReY.exe, 00000000.00000002.2413162518.000000000427D000.00000040.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590308249.0000000004656000.00000040.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607833266.00000000046C3000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibD
Source: MPGPH131.exe, 0000000A.00000002.2607924286.0000000005F30000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2178291011.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52?F
Source: MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52U
Source: MPGPH131.exe, 00000009.00000003.2178291011.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/dx
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2178291011.0000000004326000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52
Source: ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MPGPH131.exe, 0000000A.00000002.2607017449.000000000442E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.000000000445F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: ygm2mXUReY.exe, 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, ygm2mXUReY.exe, 00000000.00000003.2008770227.0000000006070000.00000004.00001000.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414862397.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590418032.0000000005FE0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2045834607.0000000006180000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2587702238.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2046639199.00000000060D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2604776514.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2607924286.0000000005F30000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Content-Type:
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043DC000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043DC000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043DD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.000000000446A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: MPGPH131.exe, 00000009.00000002.2589750462.00000000042C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/l
Source: ygm2mXUReY.exe, 00000000.00000002.2413282182.00000000043B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/rb
Source: ygm2mXUReY.exe, 00000000.00000002.2413282182.00000000043AD000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2413282182.00000000043D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2589750462.00000000042DB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.000000000446A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.000000000443E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52
Source: ygm2mXUReY.exe, 00000000.00000002.2413282182.00000000043AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52=J
Source: MPGPH131.exe, 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52a9
Source: MPGPH131.exe, 0000000A.00000002.2607017449.000000000443E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52e
Source: ygm2mXUReY.exe, 00000000.00000002.2413282182.0000000004393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/z=
Source: ygm2mXUReY.exe, 00000000.00000002.2413282182.00000000043D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52
Source: MPGPH131.exe, 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52(
Source: MPGPH131.exe, 0000000A.00000002.2607017449.000000000446A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52?
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: ygm2mXUReY.exe, 00000000.00000002.2415576693.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2413282182.000000000435E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2589750462.000000000428E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.00000000043F8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2439521788.0000000008E04000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2608848110.0000000008E08000.00000004.00000020.00020000.00000000.sdmp, SZDEAvOWuc1j5blWLO4H6aA.zip.0.dr, dxTuy4jPkMDKvqGzbwvO8nc.zip.10.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: MPGPH131.exe, 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2439521788.0000000008E04000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2608848110.0000000008E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTV
Source: MPGPH131.exe, 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTd
Source: MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2608848110.0000000008E08000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.10.dr, passwords.txt.0.dr	String found in binary or memory: https://t.me/risepro_bot
Source: MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot-
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot6F
Source: MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot9
Source: MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botl
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrisepro
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot~Fxt
Source: ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ygm2mXUReY.exe, 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, ygm2mXUReY.exe, 00000000.00000003.2008770227.0000000006070000.00000004.00001000.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414862397.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590418032.0000000005FE0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2045834607.0000000006180000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2587702238.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2046639199.00000000060D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2604776514.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2607924286.0000000005F30000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: ygm2mXUReY.exe, 00000000.00000003.2221967166.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: ygm2mXUReY.exe, 00000000.00000003.2220067370.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2214238152.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2224382558.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377717823.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2212085169.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2214654072.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2219193682.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2220945859.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2220398763.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2221967166.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2210682091.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2217585171.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2223890985.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2294441713.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2274481125.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2280241970.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2275529201.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2289744340.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/N
Source: ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377717823.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/n
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: ygm2mXUReY.exe, 00000000.00000003.2220067370.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2214238152.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2224382558.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377717823.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2212085169.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2214654072.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2219193682.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2220945859.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2220398763.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2221967166.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2210682091.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2217585171.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2223890985.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2294441713.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2274481125.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2280241970.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2275529201.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2289744340.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: ygm2mXUReY.exe, 00000000.00000003.2217585171.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2212085169.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2220067370.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377717823.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2214654072.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2214238152.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2210682091.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2219193682.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377717823.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2224382558.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2223890985.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2220945859.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2220398763.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2221967166.0000000008E19000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004371000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/6)
Source: MPGPH131.exe, 00000009.00000002.2590179683.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004371000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/atata
Source: MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/eG
Source: ygm2mXUReY.exe, 00000000.00000003.2220067370.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2214238152.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2224382558.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377717823.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2212085169.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2214654072.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2219193682.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2220945859.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2220398763.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2221967166.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2210682091.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2217585171.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2223890985.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2294441713.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2274481125.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2280241970.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2275529201.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2289744340.0000000008E1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49725 version: TLS 1.2

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Code function: 0_2_004F2150 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,DeleteObject,GdipDisposeImage,DeleteObject,ReleaseDC,GdiplusShutdown,

0_2_004F2150

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000A.00000002.2607924286.0000000005F30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2413162518.000000000427D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.2607833266.00000000046C3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.2590308249.0000000004656000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.2590418032.0000000005FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2414862397.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045504E	0_2_0045504E
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045B010	0_2_0045B010
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0049D110	0_2_0049D110
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_005041A0	0_2_005041A0
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_004091BF	0_2_004091BF
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0040D468	0_2_0040D468
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0040E58B	0_2_0040E58B
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_004F6660	0_2_004F6660
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_004CC610	0_2_004CC610
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_004B36B0	0_2_004B36B0
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045A790	0_2_0045A790
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_004DF790	0_2_004DF790
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_004DB860	0_2_004DB860
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0043A8BD	0_2_0043A8BD
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_00506920	0_2_00506920
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_005209F0	0_2_005209F0
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0054B990	0_2_0054B990
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0040CA55	0_2_0040CA55
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_00453C30	0_2_00453C30
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_00506DD0	0_2_00506DD0
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0042A040	0_2_0042A040
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0044F050	0_2_0044F050
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_00409010	0_2_00409010
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_004FC0A0	0_2_004FC0A0
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_004FB0A0	0_2_004FB0A0
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_005040A0	0_2_005040A0
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_00510140	0_2_00510140
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_00553170	0_2_00553170

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 796

Source: ygm2mXUReY.exe, 00000000.00000003.2023742197.00000000043B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires( vs ygm2mXUReY.exe
Source: ygm2mXUReY.exe, 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs ygm2mXUReY.exe
Source: ygm2mXUReY.exe, 00000000.00000003.2023118340.00000000043AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires( vs ygm2mXUReY.exe
Source: ygm2mXUReY.exe, 00000000.00000003.2008770227.0000000006070000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs ygm2mXUReY.exe
Source: ygm2mXUReY.exe, 00000000.00000000.2007505852.00000000040D8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs ygm2mXUReY.exe
Source: ygm2mXUReY.exe, 00000000.00000002.2414862397.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs ygm2mXUReY.exe
Source: ygm2mXUReY.exe	Binary or memory string: OriginalFilenameFires( vs ygm2mXUReY.exe

Source: ygm2mXUReY.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0000000A.00000002.2607924286.0000000005F30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2413162518.000000000427D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.2607833266.00000000046C3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.2590308249.0000000004656000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.2590418032.0000000005FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2414862397.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/114@2/3

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4268:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess736
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1672
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5504

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Command line argument: 131	0_2_00453C30
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Command line argument: 131	0_2_00453C30
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Command line argument: Dk43l_dwmk438*	0_2_00453C30

Source: ygm2mXUReY.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ygm2mXUReY.exe, 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, ygm2mXUReY.exe, 00000000.00000003.2008770227.0000000006070000.00000004.00001000.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414862397.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590418032.0000000005FE0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2045834607.0000000006180000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2587702238.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2046639199.00000000060D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2604776514.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2607924286.0000000005F30000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: ygm2mXUReY.exe, 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, ygm2mXUReY.exe, 00000000.00000003.2008770227.0000000006070000.00000004.00001000.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414862397.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590418032.0000000005FE0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2045834607.0000000006180000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2587702238.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2046639199.00000000060D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2604776514.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2607924286.0000000005F30000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: ygm2mXUReY.exe, 00000000.00000003.2212874316.000000000901F000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2211674747.0000000008E29000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2220253774.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2290422412.0000000008F8F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2290821951.0000000008E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277951869.0000000008E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2275318920.0000000008E29000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2263800079.0000000008DFF000.00000004.00000020.00020000.00000000.sdmp, TMHi1BjWgM9QLogin Data.0.dr, u7JVJIshcVUFLogin Data.10.dr, D_PqPMh3t76fLogin Data.0.dr, BvIYddkfIBauLogin Data.10.dr, MRFQeKpv_Q9HLogin Data For Account.10.dr, e1b5ormmlkNOLogin Data For Account.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: ygm2mXUReY.exe

Virustotal: Detection: 39%

Source: MPGPH131.exe	String found in binary or memory: ROvnJ6yzezSSPinQzhbMTdDO9znHdTFLV9oT2ILVkKv+VZz7xhndv5l59fQFVfnl4yeuSiVk+jiJVF0Mr52dH/adDcDoEL+0QvC82BBNvNfiDcOPzSbEn8KbKPFXmSz6flFNV+b2z0Z0nzAmDT941n65Rq3W6uUqPdzrn1rqo0ZhPNJhXpCbZX4iwhntgZ3otzlgZDLr9Rw4cWO50llt0fwf/3t/Dz/sxu8AwucBCw+oPWuv7MeffgtNZPWDfX7CNVSU
Source: MPGPH131.exe	String found in binary or memory: a13xzZPGcI8Ndq0kjBPDdM8VeCYp5RRM0+dYlJPh/ADd756Sj6Q6imTq57Sd6eekiPUU7JQT424emp4HFR+4gRT8o4EU/lhCaZMr2BK3bVgyhghLuqtpFxUWpFH1TBljBUZtSeGqeIIGabyB8cwBTUjVEs20rKyuHwHX6O548RE8iltT+VTZlg+tVd+qZNsjAr1Wwebo4o0Uqm7NVKZuzRSGXtgpNJUYaQSRqpJNFKNhTpKS0aI5UeXEIsQS6nDEkuZC
Source: MPGPH131.exe	String found in binary or memory: CQFb4t0QHeCl3stFpWt++XwLP/MB1MA8MCfvlo8tgxZb2z/3GAkbP/Aoj8OEQvBZ6fPFYMH8Vo6SnwfnNT1A862mvStouRTEPIi3saay3umbqcEKojMhF79SWNyjiKpYHVdq1e2Od4OTFHaXYmrA4aKVUmbiQ4n4+MZLmROvnJ6yzezSSPinQzhbMTdDO9znHdTFLV9oT2ILVkKv+VZz7xhndv5l59fQFVfnl4yeuSiVk+jiJVF0Mr52dH/adDcDoEL+
Source: MPGPH131.exe	String found in binary or memory: s39OjbOf7id1gtxPSPZYG1tuNmOm1S4/hgieOR9hhxoxnkhYpIRFSlikhEVq5BGiibJIaRQg0hgWqb/DtEj9qyFZpPQRtkjxCKKQXcqQ+2aIkrmn9L10T0VSRCPhnioIjEhgRAIjEhiRwIjGFyMaK/eUulv3FK6RznFPxa13xzZPGcI8Ndq0kjBPDdM8VeCYp5RRM0+dYlJPh/ADd756Sj6Q6imTq57Sd6eekiPUU7JQT424emp4HFR+4gRT8o4EU/lh
Source: MPGPH131.exe	String found in binary or memory: v+VZz7xhndv5l59fQFVfnl4yeuSiVk+jiJVF0Mr52dH/adDcDoEL+0QvC82BBNvNfiDcOPzSbEn8KbKPFXmSz6flFNV+b2z0Z0nzAmDT941n65Rq3W6uUqPdzrn1rqo0ZhPNJhXpCbZX4iwhntgZ3otzlgZDLr9Rw4cWO50llt0fwf/3t/Dz/sxu8AwucBCw+oPWuv7MeffgtNZPWDfX7CNVSU8C93PFaSKTCRGfOwVhvm6YJ8mui7JpEDwSkHwrycH0
Source: MPGPH131.exe	String found in binary or memory: S4/hgieOR9hhxoxnkhYpIRFSlikhEVq5BGiibJIaRQg0hgWqb/DtEj9qyFZpPQRtkjxCKKQXcqQ+2aIkrmn9L10T0VSRCPhnioIjEhgRAIjEhiRwIjGFyMaK/eUulv3FK6RznFPxa13xzZPGcI8Ndq0kjBPDdM8VeCYp5RRM0+dYlJPh/ADd756Sj6Q6imTq57Sd6eekiPUU7JQT424emp4HFR+4gRT8o4EU/lhCaZMr2BK3bVgyhghLuqtpFxUWpFH1

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

File read: C:\Users\user\Desktop\ygm2mXUReY.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ygm2mXUReY.exe "C:\Users\user\Desktop\ygm2mXUReY.exe"
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 796
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 952
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 984
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 992
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 1056
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 800
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 772
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 1380
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 896
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 1388
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 900
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 916
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 912
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 948
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1100
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msimg32.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msvcr100.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: ygm2mXUReY.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ]C:\wedigi\reciforeb\tetuguhuc\y.pdb source: ygm2mXUReY.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr
Source:	Binary string: C:\wedigi\reciforeb\tetuguhuc\y.pdb source: ygm2mXUReY.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Unpacked PE file: 0.2.ygm2mXUReY.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 10.2.MPGPH131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Unpacked PE file: 0.2.ygm2mXUReY.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 10.2.MPGPH131.exe.400000.0.unpack

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_0-20082

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_0-20083

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

0_2_0045A5C0

Source: C:\Users\user\Desktop\ygm2mXUReY.exe TID: 3192	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1856	Thread sleep count: 101 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1856	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4432	Thread sleep count: 101 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_004D0620 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004D0620
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_004F2870 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004F2870
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0042C82B FindClose,FindFirstFileExW,GetLastError,	0_2_0042C82B

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ygm2mXUReY.exe_65396d3389e0d0bfd23059c0a7ad776d4579bbf9_66eab1d0_2bf57861-c4ef-4b8b-97e9-ae95bb3c92d5\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_782df4d4-a9ed-4ef0-9c2b-b94a67192a7b\

Source: MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWu
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: formVMware20,11696428655
Source: MPGPH131.exe, 00000009.00000003.2296684755.0000000008F93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,1169642865p
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ccount.microsoft.com/profileVMware20,11696428655u
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT service, encrypted_token FROM token_servicerr global passwords blocklistVMware20,11696428655
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r global passwords blocklistVMware20,11696428655
Source: ygm2mXUReY.exe, 00000000.00000002.2415576693.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}gramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows8ZAAAA``I
Source: ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_92579849:FTt_
Source: MPGPH131.exe, 00000009.00000003.2292406288.0000000008F8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696428655
Source: MPGPH131.exe, 0000000A.00000002.2607017449.00000000043F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: ygm2mXUReY.exe, 00000000.00000002.2413282182.0000000004350000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000IFIER=Intel64 Family 6 Model @
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: MPGPH131.exe, 00000009.00000003.2292406288.0000000008F8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT name, value FROM autofillmain'.sqlite_masterr global passwords blocklistVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\*
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: MPGPH131.exe	Binary or memory string: hgFsatiaOZiP5ud66KrfNQakFogGwqi01OGshxNLlXk75qdnYqEmja4bFX50KvIXsUhbKrnbOpHRo5rei0yg1qt3msWkBojOykFtdII2ep8Ti5TC6idfMCnds9Npph6Fqyu1pQe3o5O3p7yYZqcVUtG1R0ejStP9RHuhTF0KXntOn9xGOgHsABEhd4KFsN9MvtQZdJWYqjSF1BtshZUYEEghs8BkuMryRbq1kaSnMG0jvJhXLWSsyBzLkeFQZDuwCEck
Source: MPGPH131.exe	Binary or memory string: uehgFsatiaOZiP5ud66KrfNQakFogGwqi01OGshxNLlXk75qdnYqEmja4bFX50KvIXsUhbKrnbOpHRo5rei0yg1qt3msWkBojOykFtdII2ep8Ti5TC6idfMCnds9Npph6Fqyu1pQe3o5O3p7yYZqcVUtG1R0ejStP9RHuhTF0KXntOn9xGOgHsABEhd4KFsN9MvtQZdJWYqjSF1BtshZUYEEghs8BkuMryRbq1kaSnMG0jvJhXLWSsyBzLkeFQZDuwCE
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: MPGPH131.exe, 0000000A.00000003.2276920774.0000000008E2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PasswordVMware20,1169642
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: MPGPH131.exe, 0000000A.00000003.2089367371.0000000004458000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000009.00000003.2442940053.0000000004371000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_92579849m
Source: MPGPH131.exe, 00000009.00000003.2296684755.0000000008F93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,116
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MPGPH131.exe, 00000009.00000003.2296684755.0000000008F93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428x
Source: ygm2mXUReY.exe, 00000000.00000003.2044956721.00000000043C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}P
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rootpagecomVMware20,11696428655o
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pageformVMware20,11696428655
Source: MPGPH131.exe, 0000000A.00000003.2276920774.0000000008E2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zure.comVMware20,1169642
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: MPGPH131.exe, 0000000A.00000002.2607583034.00000000044DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_92579849
Source: MPGPH131.exe, 0000000A.00000003.2276920774.0000000008E2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ansaction PasswordVMware6
Source: MPGPH131.exe, 00000009.00000003.2292406288.0000000008F8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696 T
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: MPGPH131.exe	Binary or memory string: ehgFsatiaOZiP5ud66KrfNQakFogGwqi01OGshxNLlXk75qdnYqEmja4bFX50KvIXsUhbKrnbOpHRo5rei0yg1qt3msWkBojOykFtdII2ep8Ti5TC6idfMCnds9Npph6Fqyu1pQe3o5O3p7yYZqcVUtG1R0ejStP9RHuhTF0KXntOn9xGOgHsABEhd4KFsN9MvtQZdJWYqjSF1BtshZUYEEghs8BkuMryRbq1kaSnMG0jvJhXLWSsyBzLkeFQZDuwCEc
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}<
Source: ygm2mXUReY.exe, 00000000.00000002.2413282182.00000000043B1000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2589750462.00000000042DF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004325000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MPGPH131.exe	Binary or memory string: CKQMC7RUN74ZnXXnXfhxjfIuiZlHWLOEZh7yU2OUXaC0KOu1lA7guRD8jUl+YL/jV4e4s8Af3Yf0SL+EH9Nir8/I/6cgr8AuehgFsatiaOZiP5ud66KrfNQakFogGwqi01OGshxNLlXk75qdnYqEmja4bFX50KvIXsUhbKrnbOpHRo5rei0yg1qt3msWkBojOykFtdII2ep8Ti5TC6idfMCnds9Npph6Fqyu1pQe3o5O3p7yYZqcVUtG1R0ejStP9RHu
Source: MPGPH131.exe, 00000009.00000002.2589750462.0000000004280000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&T9
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: MPGPH131.exe, 0000000A.00000003.2089367371.0000000004458000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000009.00000003.2292406288.0000000008F8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,1169642865
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}-
Source: MPGPH131.exe, 00000009.00000003.2292406288.0000000008F8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,116HQ
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ra Change Transaction PasswordVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o.inVMware20,11696428655~
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,116(
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: MPGPH131.exe	Binary or memory string: C0KOu1lA7guRD8jUl+YL/jV4e4s8Af3Yf0SL+EH9Nir8/I/6cgr8AuehgFsatiaOZiP5ud66KrfNQakFogGwqi01OGshxNLlXk75qdnYqEmja4bFX50KvIXsUhbKrnbOpHRo5rei0yg1qt3msWkBojOykFtdII2ep8Ti5TC6idfMCnds9Npph6Fqyu1pQe3o5O3p7yYZqcVUtG1R0ejStP9RHuhTF0KXntOn9xGOgHsABEhd4KFsN9MvtQZdJWYqjSF1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: MPGPH131.exe, 00000009.00000002.2589750462.00000000042EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}b9
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARtive Brokers - non-EU EuropeVMware20,11696428655
Source: MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: comVMware20,11696428655o
Source: MPGPH131.exe, 0000000A.00000002.2607583034.00000000044DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_92579849T
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: MPGPH131.exe, 00000009.00000003.2440628791.0000000004371000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\*H9
Source: FsARZr9gVanTWeb Data.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: MPGPH131.exe, 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQ
Source: MPGPH131.exe, 0000000A.00000003.2280109698.0000000008E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: MPGPH131.exe, 00000009.00000003.2092896706.00000000042F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}v8
Source: ygm2mXUReY.exe, 00000000.00000002.2413282182.0000000004350000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000OD

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Code function: 0_2_004E2080 IsDebuggerPresent,IsProcessorFeaturePresent,GetVolumeInformationA,

0_2_004E2080

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Code function: 0_2_0045504E CreateThread,FindCloseChangeNotification,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

0_2_0045504E

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045504E mov eax, dword ptr fs:[00000030h]	0_2_0045504E
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045504E mov ecx, dword ptr fs:[00000030h]	0_2_0045504E
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045A5C0 mov eax, dword ptr fs:[00000030h]	0_2_0045A5C0
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045A5C0 mov eax, dword ptr fs:[00000030h]	0_2_0045A5C0
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_004DF790 mov ecx, dword ptr fs:[00000030h]	0_2_004DF790
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_00453C30 mov eax, dword ptr fs:[00000030h]	0_2_00453C30
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Code function: 0_2_00453C30 mov ecx, dword ptr fs:[00000030h]	0_2_00453C30

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Code function: 0_2_004FA050 GetProcessHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_004FA050

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Code function: 0_2_00453C30 Sleep,GetCurrentProcess,SetPriorityClass,SetUnhandledExceptionFilter,SetThreadExecutionState,SetThreadExecutionState,LoadLibraryA,GetModuleFileNameA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetProcessId,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetThreadExecutionState,SetThreadExecutionState,LoadLibraryA,CreateThread,FindCloseChangeNotification,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,SetCurrentDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,CreateThread,CreateThread,CreateThread,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

0_2_00453C30

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Code function: 0_2_004DB860 GetModuleFileNameA,GetUserNameA,CopyFileA,CopyFileA,__Xtime_get_ticks,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,GetModuleFileNameA,CopyFileA,

0_2_004DB860

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Code function: 0_2_004479BE GetTimeZoneInformation,

0_2_004479BE

Source: C:\Users\user\Desktop\ygm2mXUReY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.2415576693.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2439521788.0000000008E04000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2413282182.000000000435E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2608848110.0000000008E08000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ygm2mXUReY.exe PID: 5504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 736, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\SZDEAvOWuc1j5blWLO4H6aA.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\dxTuy4jPkMDKvqGzbwvO8nc.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets8b}
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.0000000004444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.0000000004444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.0000000004444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.0000000004444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.0000000004444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.0000000004444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.0000000004444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.0000000004444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: ygm2mXUReY.exe, 00000000.00000003.2377451245.0000000004444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: MPGPH131.exe, 00000009.00000003.2440628791.0000000004325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*G
Source: ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\ygm2mXUReY.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ygm2mXUReY.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 00000009.00000003.2440628791.0000000004371000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ygm2mXUReY.exe PID: 5504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 736, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.2415576693.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2439521788.0000000008E04000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2413282182.000000000435E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2608848110.0000000008E08000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ygm2mXUReY.exe PID: 5504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 736, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\SZDEAvOWuc1j5blWLO4H6aA.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\dxTuy4jPkMDKvqGzbwvO8nc.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	2 Software Packing	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Process Injection	1 DLL Side-Loading	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Masquerading	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Virtualization/Sandbox Evasion	NTDS	23 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Process Injection	LSA Secrets	1 Query Registry	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	261 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	12 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ygm2mXUReY.exe	39%	Virustotal		Browse
ygm2mXUReY.exe	100%	Avira	HEUR/AGEN.1313019
ygm2mXUReY.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	HEUR/AGEN.1313019
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	37%	ReversingLabs
C:\ProgramData\MPGPH131\MPGPH131.exe	39%	Virustotal		Browse
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	37%	ReversingLabs
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	39%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.233.132.167/cost/lenin.exe	100%	URL Reputation	malware
http://193.233.132.167/cost/lenin.exeepro	25%	Virustotal		Browse
http://193.233.132.167/cost/go.exe	25%	Virustotal		Browse
http://193.233.132.167/cost/go.exeadka.ex	25%	Virustotal		Browse
http://193.233.132.167/cost/lenin.exe0	24%	Virustotal		Browse
http://147.45.47.102:57893/hera/amadka.exe	18%	Virustotal		Browse
http://147.45.47.102:57893/hera/amadka.exea	15%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		high
db-ip.com	172.67.75.166	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/81.181.57.52	false		high
https://db-ip.com/demo/home.php?s=81.181.57.52	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	false		high
https://duckduckgo.com/ac/?q=	ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	false		high
http://193.233.132.167/cost/lenin.exeepro	MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse	unknown
http://193.233.132.167/cost/go.exeadka.ex	MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse	unknown
http://147.45.47.102:57893/hera/amadka.exe	ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377717823.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse	unknown
https://db-ip.com/	ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2178291011.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe&	ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377717823.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	false		high
https://t.me/RiseProSUPPORTd	MPGPH131.exe, 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot~Fxt	ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/Content-Type:	ygm2mXUReY.exe, 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, ygm2mXUReY.exe, 00000000.00000003.2008770227.0000000006070000.00000004.00001000.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414862397.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590418032.0000000005FE0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2045834607.0000000006180000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2587702238.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2046639199.00000000060D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2604776514.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2607924286.0000000005F30000.00000040.00001000.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exe.52	ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.167/cost/go.exe	ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse	unknown
https://ipinfo.io/widget/demo/81.181.57.52e	MPGPH131.exe, 0000000A.00000002.2607017449.000000000443E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot-	MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTV	MPGPH131.exe, 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2439521788.0000000008E04000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2608848110.0000000008E08000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/dx	MPGPH131.exe, 00000009.00000003.2178291011.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io:443/widget/demo/81.181.57.52	ygm2mXUReY.exe, 00000000.00000002.2413282182.00000000043D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=81.181.57.52U	MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	false		high
https://ipinfo.io/l	MPGPH131.exe, 00000009.00000002.2589750462.00000000042C1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/lenin.exe	ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://t.me/risepro_bot9	MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botrisepro	ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/lenin.exe0	MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse	unknown
https://db-ip.com:443/demo/home.php?s=81.181.57.52	ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004325000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2178291011.0000000004326000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io:443/widget/demo/81.181.57.52(	MPGPH131.exe, 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.winimage.com/zLibD	ygm2mXUReY.exe, 00000000.00000002.2413162518.000000000427D000.00000040.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590308249.0000000004656000.00000040.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607833266.00000000046C3000.00000040.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=81.181.57.52?F	ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exeda1t	ygm2mXUReY.exe, 00000000.00000003.2377942278.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	false		high
http://193.233.132.167/cost/go.exeate	MPGPH131.exe, 00000009.00000003.2442056915.0000000004371000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	false		high
https://ipinfo.io/widget/demo/81.181.57.52=J	ygm2mXUReY.exe, 00000000.00000002.2413282182.00000000043AD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.8.dr	false		high
https://t.me/RiseProSUPPORT	ygm2mXUReY.exe, 00000000.00000002.2415576693.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2413282182.000000000435E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2589750462.000000000428E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.00000000043F8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2439521788.0000000008E04000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2608848110.0000000008E08000.00000004.00000020.00020000.00000000.sdmp, SZDEAvOWuc1j5blWLO4H6aA.zip.0.dr, dxTuy4jPkMDKvqGzbwvO8nc.zip.10.dr	false		high
https://t.me/risepro_bot6F	ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	false		high
https://ipinfo.io/Mozilla/5.0	ygm2mXUReY.exe, 00000000.00000003.2377451245.00000000043DC000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378552588.00000000043DC000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414484022.00000000043DD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.000000000446A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.0.dr	false		high
https://ipinfo.io/z=	ygm2mXUReY.exe, 00000000.00000002.2413282182.0000000004393000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exea	MPGPH131.exe, 00000009.00000003.2442056915.0000000004371000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.0000000004371000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse	unknown
https://ac.ecosia.org/autocomplete?q=	ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	false		high
https://t.me/risepro_bot	MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2608848110.0000000008E08000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.10.dr, passwords.txt.0.dr	false		high
https://t.me/risepro_botl	MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/	MPGPH131.exe, 0000000A.00000002.2607017449.000000000442E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2607017449.000000000445F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/81.181.57.52a9	MPGPH131.exe, 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.000000000430B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.maxmind.com/en/locate-my-ip-address	ygm2mXUReY.exe, 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, ygm2mXUReY.exe, 00000000.00000003.2008770227.0000000006070000.00000004.00001000.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000002.2414862397.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590418032.0000000005FE0000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2045834607.0000000006180000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2587702238.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2046639199.00000000060D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2604776514.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2607924286.0000000005F30000.00000040.00001000.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/lenin.exeoina	ygm2mXUReY.exe, 00000000.00000002.2415674094.0000000008E23000.00000004.00000020.00020000.00000000.sdmp, ygm2mXUReY.exe, 00000000.00000003.2378193179.0000000008E23000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	D87fZN3R3jFeplaces.sqlite.0.dr	false		high
http://www.winimage.com/zLibDll	MPGPH131.exe, 0000000A.00000002.2607924286.0000000005F30000.00000040.00001000.00020000.00000000.sdmp	false		high
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.0.dr	false		high
https://ipinfo.io/rb	ygm2mXUReY.exe, 00000000.00000002.2413282182.00000000043B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	ygm2mXUReY.exe, 00000000.00000003.2214747133.0000000009032000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2277749347.0000000009025000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2272506226.0000000008E37000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2266299894.0000000008E27000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2264083152.0000000008E25000.00000004.00000020.00020000.00000000.sdmp, NdZrHbm08IDPWeb Data.0.dr, 6XPTC_VuRvwAWeb Data.0.dr, 22YOafS9AuarWeb Data.0.dr, oqeZ8c0GMjOkWeb Data.10.dr, HiTDZbYl7tFjWeb Data.10.dr, 3aqhlGTkMf6CWeb Data.10.dr	false		high
https://ipinfo.io:443/widget/demo/81.181.57.52?	MPGPH131.exe, 0000000A.00000002.2607017449.000000000446A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exeA	MPGPH131.exe, 00000009.00000003.2442547295.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2442940053.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2590179683.0000000004348000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2440628791.0000000004348000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
172.67.75.166	db-ip.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429359
Start date and time:	2024-04-22 01:52:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ygm2mXUReY.exe renamed because original name is a hash value
Original Sample Name:	d668244429e4a7a0b205b2ce843b9663.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/114@2/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 56% Number of executed functions: 84 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target MPGPH131.exe, PID 1672 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:52:53	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
01:52:54	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
01:52:57	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
01:53:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
147.45.47.93	file.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	UeW2b6mU6Z.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse
172.67.75.166	file.exe	Get hash	malicious	RisePro Stealer	Browse
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	TANQUIVUIA.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse
	oZ8kX4OA5q.exe	Get hash	malicious	RisePro Stealer	Browse
	S2ruRfajig.exe	Get hash	malicious	RisePro Stealer	Browse
	WARYTtjh4l.exe	Get hash	malicious	RisePro Stealer	Browse
	fzrGl94EQ2.exe	Get hash	malicious	RisePro Stealer	Browse
	SeR6QESSMe.exe	Get hash	malicious	RisePro Stealer	Browse
	z21FdylQJD.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	Dj43d18ukx.exe	Get hash	malicious	DCRat	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	UnderWars.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	UnderWars.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	2q45IEa3Ee.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
db-ip.com	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15
	2q45IEa3Ee.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.4.15
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	104.26.5.15
	UeW2b6mU6Z.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	Dj43d18ukx.exe	Get hash	malicious	DCRat	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	UnderWars.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	UnderWars.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	2q45IEa3Ee.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
CLOUDFLARENETUS	https://ozluc01lyejozbbzmr.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	104.21.53.38
	http://outlookaccount.rf.gd/?i=1	Get hash	malicious	Unknown	Browse	104.20.95.138
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15
	https://shiny-haze-e3f9.oriental-chef-hrg9939.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://pub-a7051849f97e40258b2898070eea69ef.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.18.3.35
	https://yxv.ens.mybluehost.me/Ca/net/login.php	Get hash	malicious	Unknown	Browse	162.247.243.29
	https://yzkgxjyz0y4417anol.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	172.66.45.32
	https://pub-ad26986ae16e4366a1d34c587ca0df93.r2.dev/megme.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://topwingroups.top/login.php	Get hash	malicious	Unknown	Browse	104.21.19.92
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	2q45IEa3Ee.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	193.233.132.253
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.226
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.226
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	jNeaezBuo8.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	193.233.132.175
	74fa486WVX.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	193.233.132.234
	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	193.233.132.226

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 172.67.75.166
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192 172.67.75.166
	https://yxv.ens.mybluehost.me/Ca/net/login.php	Get hash	malicious	Unknown	Browse	34.117.186.192 172.67.75.166
	2q45IEa3Ee.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	34.117.186.192 172.67.75.166
	Pictures.com.exe	Get hash	malicious	DBatLoader	Browse	34.117.186.192 172.67.75.166
	2FjvjcayaH.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 172.67.75.166
	qrLdMv1QXG.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 172.67.75.166
	PASS-1234.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 172.67.75.166
	file.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 172.67.75.166
	file.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 172.67.75.166

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	997888
Entropy (8bit):	7.765309926729777
Encrypted:	false
SSDEEP:	24576:opsnpECte4yQyGPLUXotoVeJVUXuJlt+ZPZzR4:opspbe3GPwZVeIeJlt+ZxzR
MD5:	D668244429E4A7A0B205B2CE843B9663
SHA1:	DD8AEE62F445DB5649840F9FFB8CB33D304254F3
SHA-256:	EF09750219F549D293572AEDB0F593EF6C4A74AC77BB99950CA8B5A91377AB89
SHA-512:	998A0CD29C6ED6B9D922E2A5706A0B9F661F4C9EC2D8F30EF942BBC69D42C8D30938297D81123C6F2B312F5F09E81E08BBC38B944A563E4D0B7B17BD28DB2438
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37% Antivirus: Virustotal, Detection: 39%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.....\|...\|...\|.......\|.....z.\|.....*.\|.......\|...}.v.\|.4....\|.......\|.4....\|.Rich..\|.........PE..L...9..c.....................t......]@............@..........................p......C........................................j..P.......X...............................8....................`......h`..@............................................text............................... ..`.rdata..0t.......v..................@..@.data................`..............@....rsrc...X............J..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_11df57f9-a911-4a76-ad6c-3fa73011ab48\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9417177043794801
Encrypted:	false
SSDEEP:	192:8E8NzE8Ow056r96E6jjJnZrMbzuiF2Z24IO8Nj6t:M5EjL56rwjGzuiF2Y4IO8e
MD5:	CF648F77C74B5C764523BD3D3BB987AE
SHA1:	1BB3886995381BA9B164FC199D60926DD1CC764E
SHA-256:	40A2EADB02CFB712123B01EDA0008738DF74F90E217B871816EBACFBA962F3E9
SHA-512:	E1980C00D73498C337B345F97A0790D6F5F7D8E3005C15D73486F9691BCDAC39D48BB55569D31D71090688BF48896EBBA50AA55ED1F16AA5B4B457289829B1FB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.8.3.3.0.7.4.3.9.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.1.d.f.5.7.f.9.-.a.9.1.1.-.4.a.7.6.-.a.d.6.c.-.3.f.a.7.3.0.1.1.a.b.4.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.8.a.1.9.f.f.2.-.a.0.9.8.-.4.7.0.4.-.a.7.0.b.-.a.e.f.c.9.3.2.2.5.1.b.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.e.0.-.0.0.0.1.-.0.0.1.4.-.2.4.a.9.-.0.8.0.7.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_312dbc34-0135-4795-993d-44365049eb94\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9418297882331839
Encrypted:	false
SSDEEP:	192:OHE8Nza8Ow056r96E6jjJnZrMbzuiF2Z24IO8Nj6t:Ol5ajL56rwjGzuiF2Y4IO8e
MD5:	7EA51700DE506FB851D5689B102DC0AA
SHA1:	B7DF625ACC6EA62E04EBF89DB63F34041C14ECE2
SHA-256:	7F7A07A8ED67A7121FBF36EDF664549A54861B986D80472B0680A8CDF47D3B46
SHA-512:	79A4804A4931C3FAD53F1A8AA922F2D962D533EBA739B2A3A119357F7FEA918C17E849BFCA9CEDC7FD333D248373F39C7E4F09814782439F12DC242ED2E22553
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.8.2.1.4.2.4.4.3.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.2.d.b.c.3.4.-.0.1.3.5.-.4.7.9.5.-.9.9.3.d.-.4.4.3.6.5.0.4.9.e.b.9.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.e.2.a.7.b.7.3.-.3.0.4.8.-.4.f.c.7.-.9.e.d.6.-.b.8.f.f.3.6.1.e.1.0.1.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.e.0.-.0.0.0.1.-.0.0.1.4.-.2.4.a.9.-.0.8.0.7.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_3d419301-bf8a-4dc3-ab87-97d54a9e0356\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.948255186733817
Encrypted:	false
SSDEEP:	192:pYLE8Nzf8Ow056r96E6jjJnZrMEzuiF2Z24IO8Nj6t:SR5fjL56rwjhzuiF2Y4IO8e
MD5:	66F68F7ECC34A463B4C3F0306689D5F8
SHA1:	8FAAAA7E058B053C9A38771317F2B46FFC766B61
SHA-256:	1A20669C2B084C3FAB5237DC3FC0F372C42D151FDB03E48A8E48D270EC9D709B
SHA-512:	264B5AE2D9115709EBD9AB448F9C9528C199C219FAAE46E83C0A9CB973A1D965590EFE285449F3B79CB77C945D96F6529A195EE8526B316BBD1E6965AB090B7F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.8.4.3.9.4.0.7.6.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.d.4.1.9.3.0.1.-.b.f.8.a.-.4.d.c.3.-.a.b.8.7.-.9.7.d.5.4.a.9.e.0.3.5.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.2.0.5.f.6.e.5.-.d.c.7.3.-.4.6.0.9.-.9.0.e.f.-.2.7.a.e.f.2.a.c.c.1.e.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.e.0.-.0.0.0.1.-.0.0.1.4.-.2.4.a.9.-.0.8.0.7.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_457182eb-5933-493a-bcc4-dd0068772e19\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.9085222453180201
Encrypted:	false
SSDEEP:	192:2QF8Nz18Ow056r96E6jjS3ZrYFzuiF2Z24IO8Nj6t:S51jL56rwj/zuiF2Y4IO8e
MD5:	54049390F02138ADCACEE0F34E772D96
SHA1:	FC4B5BB0AFD96A76466DDF94B2A0563F61A1BF00
SHA-256:	130DC150C0FEE61D611B21B473153104A47B807397E7E3DDFCDF16D43DEF51F4
SHA-512:	B242F2EAB5175E8DE5C1796E21F696202750C8E3E911B2AC1AE8872107007C27C27459E4F09D17A20E535310C439123FCC50865A3FC668CA075461C11E55D5E5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.7.8.3.3.4.6.3.6.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.5.7.1.8.2.e.b.-.5.9.3.3.-.4.9.3.a.-.b.c.c.4.-.d.d.0.0.6.8.7.7.2.e.1.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.7.2.6.6.6.d.a.-.e.3.c.5.-.4.a.8.0.-.9.6.0.3.-.6.5.f.e.4.1.6.c.f.6.0.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.8.8.-.0.0.0.1.-.0.0.1.4.-.2.f.e.d.-.9.c.0.6.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_64aa4c50-a1b6-477f-81c5-7c1101021e37\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9487587411601649
Encrypted:	false
SSDEEP:	192:cLF8Nzg8Ow056r96E6jjS3ZrYKzuiF2Z24IO8Nj6t:ce5gjL56rwjgzuiF2Y4IO8e
MD5:	2545812E24EA4EFD267798386EA8998B
SHA1:	A0C5984AF5BD3B53C92DF0FEAEE7221BD6D097A3
SHA-256:	557CCE97C1C89D5F9A8E3DEBB1F295322CCFD17BC1912072C4FF79DF109DD722
SHA-512:	447546D10B4BB9D830CAE41B803895FE572F05C4F1AC78AF20F8B407E9049C255E41C0723C2EDC2CEEF3EB2E7178C9CBD55644399A16C044B2D2CAB351A1D860
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.8.3.4.6.3.1.4.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.4.a.a.4.c.5.0.-.a.1.b.6.-.4.7.7.f.-.8.1.c.5.-.7.c.1.1.0.1.0.2.1.e.3.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.f.0.d.0.1.6.e.-.3.5.4.6.-.4.f.a.7.-.8.3.f.b.-.1.0.c.4.9.a.9.2.4.9.2.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.8.8.-.0.0.0.1.-.0.0.1.4.-.2.f.e.d.-.9.c.0.6.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_782df4d4-a9ed-4ef0-9c2b-b94a67192a7b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.9020563213787245
Encrypted:	false
SSDEEP:	192:5E8NzB8Ow056r96E6jjJnZrMCzuiF2Z24IO8Nj6t:L5BjL56rwjHzuiF2Y4IO8e
MD5:	ACC736A23F26F9634B903E759939AB7F
SHA1:	D088E7E7273EEF3948F18D384B8CB1AB829B3A22
SHA-256:	408D5ECE184A38A4550E0742AB6D39652DE8D6F5166F3BA7D20047EDF13FCDD2
SHA-512:	BB55CACF9AB1FD9E5030A3783010B19380F91A826A1B49176FE9F5E477AFD1313F7EA8211BED3BD3FAF8C9D4600B3775FC262EC5C3F236941C3F45376DB281F8
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.7.8.3.7.2.4.8.2.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.8.2.d.f.4.d.4.-.a.9.e.d.-.4.e.f.0.-.9.c.2.b.-.b.9.4.a.6.7.1.9.2.a.7.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.4.c.f.4.3.0.3.-.a.7.7.f.-.4.5.c.f.-.b.6.b.5.-.c.3.f.2.b.3.6.0.2.c.4.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.e.0.-.0.0.0.1.-.0.0.1.4.-.2.4.a.9.-.0.8.0.7.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_7ac4df01-ceba-4e94-89d2-844c94f59c45\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9420028760937459
Encrypted:	false
SSDEEP:	192:nE8Nz18Ow056r96E6jjJnZrMbzuiF2Z24IO8Nj6t:F51jL56rwjGzuiF2Y4IO8e
MD5:	DE816D05E9F3C4F14CCD122BEF2D8290
SHA1:	B838768EF586E612010B6C1B2C82DA2EAD5AE0BB
SHA-256:	6A77770CBD4017B4A93638DBD487053498546A93791ED39CBDD76CAE978FD852
SHA-512:	FA87CB6BC58E77DFDF30961D6AB1A827BA6EA46D6ECB979BC712B77A53606C7B372684117A653A7633DE1797432567B53A277A168788059892822DD9E0790379
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.8.0.3.2.9.0.3.9.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.a.c.4.d.f.0.1.-.c.e.b.a.-.4.e.9.4.-.8.9.d.2.-.8.4.4.c.9.4.f.5.9.c.4.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.0.f.0.c.6.9.4.-.5.1.3.3.-.4.0.3.8.-.a.0.0.d.-.6.1.c.0.4.c.9.b.1.f.5.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.e.0.-.0.0.0.1.-.0.0.1.4.-.2.4.a.9.-.0.8.0.7.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_9507a248-5cec-477c-965b-79a1daac08d5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9285531662345988
Encrypted:	false
SSDEEP:	192:5F8Nz78Ow056r96E6jjS3ZrYCzuiF2Z24IO8Nj6t:Y57jL56rwjYzuiF2Y4IO8e
MD5:	5E93C8434A167D92016B5AED5761AFB4
SHA1:	8B8220B4FA3A73A420B369AF3021BEF3D8CA741C
SHA-256:	D750D0F22BD5E14F4432B1417877D3FDB9E5BA2452157B0A178F7CF20AAC3101
SHA-512:	23BA7269FB9ACC1708B6CB68590A5FE5BA3657D1A43E9A8529C5495289778E66BE0E7A99273D8D334095F6CF68C01C097D75BCE843C38BD4C603C42821B11F3E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.8.0.8.5.1.9.4.8.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.5.0.7.a.2.4.8.-.5.c.e.c.-.4.7.7.c.-.9.6.5.b.-.7.9.a.1.d.a.a.c.0.8.d.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.6.7.5.0.4.9.3.-.2.2.e.0.-.4.e.3.4.-.a.e.f.4.-.d.2.0.d.d.5.6.4.6.e.b.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.8.8.-.0.0.0.1.-.0.0.1.4.-.2.f.e.d.-.9.c.0.6.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_b4010589-7351-456c-928a-338198f9d087\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9358127774326155
Encrypted:	false
SSDEEP:	192:+rRiF8Nzc68Ow056r96E6jjS3ZrYDzuiF2Z24IO8Nj6t:+Nh5ZjL56rwjJzuiF2Y4IO8e
MD5:	1EBF86EC9D3E2EA2D3BD8F3A4554181B
SHA1:	39AC1A94A7D33082D618B2565DBA750037CC771B
SHA-256:	E936E69C50A83C2B20D9D98B1B973BFC700D6A370B070E1E4195DA30403F8302
SHA-512:	CDD734BF235BE46C3A8EF3E24B9D7C2E5A0C8E1A1E84358BFDD9DD55D86C97976EAE517B5252A0BFBB8F729FEA85F0F6C9EDDAA11EF5DB9F97BA49BB7FBDC38B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.8.2.4.3.1.8.6.0.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.4.0.1.0.5.8.9.-.7.3.5.1.-.4.5.6.c.-.9.2.8.a.-.3.3.8.1.9.8.f.9.d.0.8.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.7.b.e.d.b.3.d.-.2.2.1.1.-.4.2.a.5.-.8.9.7.6.-.5.a.a.b.7.2.c.3.7.1.b.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.8.8.-.0.0.0.1.-.0.0.1.4.-.2.f.e.d.-.9.c.0.6.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ygm2mXUReY.exe_65396d3389e0d0bfd23059c0a7ad776d4579bbf9_66eab1d0_231ce3d8-5135-43dc-a832-9839be86e7db\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0043834928951267
Encrypted:	false
SSDEEP:	96:ksTa5CYdmPIC4s2tYqOoA7Rh6tQXIDcQnc6rCcEhcw3r3/j+HbHg/opAnQr39DD8:uan4dw056rwjS3ZrYTBzuiF2Z24IO8+
MD5:	085966659594E5005A50FC88524876D7
SHA1:	D67F74A627A9BB31E8D7A523A22F6824FDAA839E
SHA-256:	7B4D4C622153DF8EA6973A95C498081E5D081B3B98583B8ACD6F393BACDE9CC3
SHA-512:	1074BB52C622B6EF0F5579383911AFE1110F5BFC32D6A8EFD05D3DC2594375D9A17359850FF13AA47213B9CB0D164DC882090C28F0CA612CD1B7C506BC2684D1
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.7.9.7.6.2.1.7.8.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.3.1.c.e.3.d.8.-.5.1.3.5.-.4.3.d.c.-.a.8.3.2.-.9.8.3.9.b.e.8.6.e.7.d.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.4.2.e.9.6.5.4.-.f.4.7.9.-.4.0.3.0.-.a.f.6.8.-.0.7.c.e.6.9.7.c.1.c.9.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.g.m.2.m.X.U.R.e.Y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.8.0.-.0.0.0.1.-.0.0.1.4.-.7.1.2.9.-.0.f.0.5.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.a.8.9.3.3.a.c.f.a.9.a.c.8.7.a.0.f.f.a.3.b.e.b.b.1.e.c.d.7.6.f.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ygm2mXUReY.exe_65396d3389e0d0bfd23059c0a7ad776d4579bbf9_66eab1d0_2bf57861-c4ef-4b8b-97e9-ae95bb3c92d5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9172770899521122
Encrypted:	false
SSDEEP:	96:ukWa5CYdmPIC8s2tYqOoA7Rh6tQXIDcQnc6rCcEhcw3r3/j+HbHg/opAnQr39DDm:Pan8dw056rwjS3ZrY3zuiF2Z24IO8+
MD5:	37F890C7D30489AA64ECFF7437805BDE
SHA1:	2180A0E51B5CAB9F287C767CBCB5592865DD3F09
SHA-256:	6E79A87AC3037A21654B5565E95DE340F11FF6ED30949C798124EBE46043A1B0
SHA-512:	460BCA4F06AF479CC3ADA84A19F276729E2678F966AB8EB373C31FBA8572D6587B1FE86D9E66A78BE72E205703716CC724D40167069523C3994D10CC121DDCD6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.7.3.7.2.3.8.6.6.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.b.f.5.7.8.6.1.-.c.4.e.f.-.4.b.8.b.-.9.7.e.9.-.a.e.9.5.b.b.3.c.9.2.d.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.f.a.5.7.e.a.3.-.1.c.3.3.-.4.7.b.e.-.b.1.3.8.-.d.b.6.6.2.f.2.8.7.d.d.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.g.m.2.m.X.U.R.e.Y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.8.0.-.0.0.0.1.-.0.0.1.4.-.7.1.2.9.-.0.f.0.5.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.a.8.9.3.3.a.c.f.a.9.a.c.8.7.a.0.f.f.a.3.b.e.b.b.1.e.c.d.7.6.f.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ygm2mXUReY.exe_65396d3389e0d0bfd23059c0a7ad776d4579bbf9_66eab1d0_31ad85ba-b8f8-437e-acc5-4874b249f007\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9570101763760863
Encrypted:	false
SSDEEP:	96:Wv1a5CYdmPIC9s2tYqOoA7Rh6tQXIDcQnc6rCcEhcw3r3/j+HbHg/opAnQr39DDb:nan9dw056rwjS3ZrYKzuiF2Z24IO8+
MD5:	15AAFB72D39EC78980202ED72E00200B
SHA1:	A8E90C235F41B9ECC0A25BD3522D89841B577AFA
SHA-256:	58BEBEB03603BAF50162B5FEE690F510878B223BF8C6E2C5FF4E4285E68B969A
SHA-512:	1DC47EA6ABB710D117D21533CFF64C0C18AAD847562C864EE56DD535171D7F71DEC550FE8FDF0618A3FC8D1BFDCD1C3BA9FE241E8E7058716ACC81C772F9832C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.7.7.1.8.5.6.2.4.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.a.d.8.5.b.a.-.b.8.f.8.-.4.3.7.e.-.a.c.c.5.-.4.8.7.4.b.2.4.9.f.0.0.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.a.4.c.0.d.b.a.-.4.7.d.e.-.4.9.c.2.-.a.6.8.2.-.d.2.8.7.e.7.4.3.6.e.d.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.g.m.2.m.X.U.R.e.Y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.8.0.-.0.0.0.1.-.0.0.1.4.-.7.1.2.9.-.0.f.0.5.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.a.8.9.3.3.a.c.f.a.9.a.c.8.7.a.0.f.f.a.3.b.e.b.b.1.e.c.d.7.6.f.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ygm2mXUReY.exe_65396d3389e0d0bfd23059c0a7ad776d4579bbf9_66eab1d0_462ceb47-b992-432d-8264-7ff329454d6f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9302268779181179
Encrypted:	false
SSDEEP:	96:6zHjqa5CYdmPICPs2tYqOoA7Rh6tQXIDcQnc6rCcEhcw3r3/j+HbHg/opAnQr39Y:canPdw056rwjS3ZrY9zuiF2Z24IO8+
MD5:	B735CB89093B533DABF186D0711EAEF8
SHA1:	39A7638C5F2499204E6DBAA4A05A0D61FC8EAE89
SHA-256:	E89B497D5957D0DCB2085D6E6414C5369F993FE668F6C9D1266B76DD0326FAC4
SHA-512:	3D43F07201B943CB936F8E9DF58574296C3697C49EA8D7AD558CFF6B841D00300477A383471816CC8B28E415387B7521E1A8C4C9BB1D1CC8581043EF681DC697
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.7.5.7.2.3.2.1.2.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.6.2.c.e.b.4.7.-.b.9.9.2.-.4.3.2.d.-.8.2.6.4.-.7.f.f.3.2.9.4.5.4.d.6.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.c.1.d.d.e.6.5.-.4.8.d.9.-.4.9.1.a.-.8.a.e.f.-.f.d.a.e.e.0.2.d.0.3.d.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.g.m.2.m.X.U.R.e.Y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.8.0.-.0.0.0.1.-.0.0.1.4.-.7.1.2.9.-.0.f.0.5.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.a.8.9.3.3.a.c.f.a.9.a.c.8.7.a.0.f.f.a.3.b.e.b.b.1.e.c.d.7.6.f.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ygm2mXUReY.exe_65396d3389e0d0bfd23059c0a7ad776d4579bbf9_66eab1d0_793f1f16-da2c-4abb-bbfb-a3182d08cc53\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9571986676365808
Encrypted:	false
SSDEEP:	192:GOmantdw056rwjS3ZrYKzuiF2Z24IO8+:GBantdL56rwjQzuiF2Y4IO8+
MD5:	17AA447409FC21110260DF52C345720D
SHA1:	5313C50FFFCC8A4230962E0E8D786CC591B73E0E
SHA-256:	B8DE22DF432F6CE7FD8CAA44F79699BE0350117C6AB343E0EEB3F7731425014F
SHA-512:	54F8FBB7ED96AFD06A85B78E2665C9CA20DC3A0959AF9668CB716CDEF1BB346EC018D56DD8C47C92A658E1840C29ED7CA53EFC8E18D4503ABE26BC17F3223055
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.7.8.0.9.4.0.6.8.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.9.3.f.1.f.1.6.-.d.a.2.c.-.4.a.b.b.-.b.b.f.b.-.a.3.1.8.2.d.0.8.c.c.5.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.d.1.6.2.3.2.e.-.c.8.c.7.-.4.f.6.3.-.8.7.b.a.-.f.f.9.3.d.8.c.6.3.9.4.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.g.m.2.m.X.U.R.e.Y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.8.0.-.0.0.0.1.-.0.0.1.4.-.7.1.2.9.-.0.f.0.5.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.a.8.9.3.3.a.c.f.a.9.a.c.8.7.a.0.f.f.a.3.b.e.b.b.1.e.c.d.7.6.f.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ygm2mXUReY.exe_65396d3389e0d0bfd23059c0a7ad776d4579bbf9_66eab1d0_846b0825-30d1-4e15-a1b5-b4019b8a9ef3\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9567307371811344
Encrypted:	false
SSDEEP:	96:gZdNka5CYdmPICLs2tYqOoA7Rh6tQXIDcQnc6rCcEhcw3r3/j+HbHg/opAnQr397:AanLdw056rwjS3ZrYKzuiF2Z24IO8+
MD5:	79E31022B309EE7BBD5D9939E98F52B8
SHA1:	919C57B46F6D6AF2574F99E2D3C39314E3158E8F
SHA-256:	0D0893D76677CAE2970B445CF7E5F593EA24869838687C2F26A813688D04BA04
SHA-512:	57265BDC03AB911C37D19237361FD9D4375EF61214CF3E7AA49F46B174A35CDEFB5C9B8A1AEA99F6D141B5B811431870C26263ACEFB08AD6D91B1F6E0F1A7121
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.7.6.4.2.5.6.0.4.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.4.6.b.0.8.2.5.-.3.0.d.1.-.4.e.1.5.-.a.1.b.5.-.b.4.0.1.9.b.8.a.9.e.f.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.e.3.6.7.2.d.a.-.4.5.f.f.-.4.6.8.2.-.b.c.5.9.-.5.3.f.0.2.c.8.0.7.4.3.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.g.m.2.m.X.U.R.e.Y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.8.0.-.0.0.0.1.-.0.0.1.4.-.7.1.2.9.-.0.f.0.5.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.a.8.9.3.3.a.c.f.a.9.a.c.8.7.a.0.f.f.a.3.b.e.b.b.1.e.c.d.7.6.f.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ygm2mXUReY.exe_65396d3389e0d0bfd23059c0a7ad776d4579bbf9_66eab1d0_9c2ce2f8-bddb-4357-b487-46476e6771ba\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0110414557284957
Encrypted:	false
SSDEEP:	192:danEdw056rwjS3ZrYT4zuiF2Z24IO8+5:danEdL56rwjuzuiF2Y4IO8+5
MD5:	8EFADA145FDA0006BC5526E53E6E69E5
SHA1:	1FCFA9574158190E93E0EB1190BC0C3937932239
SHA-256:	7CBCEBBD43EF0C4907D266CA55D621C1FFBA3507B3695C5B96ACED1099D10277
SHA-512:	99E4CBE459A75B544ADBCBAEED8DBBAC7598FB92EC8A5ED3BBD16B97233133398A782302AD8445BB7A17CBACD046877E66FDC2D158CE249479D61D599C233A60
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.7.1.8.0.8.7.2.3.6.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.2.c.e.2.f.8.-.b.d.d.b.-.4.3.5.7.-.b.4.8.7.-.4.6.4.7.6.e.6.7.7.1.b.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.8.f.1.3.c.7.2.-.7.f.7.2.-.4.b.3.1.-.9.2.4.7.-.9.1.3.5.e.4.7.f.5.5.7.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.g.m.2.m.X.U.R.e.Y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.8.0.-.0.0.0.1.-.0.0.1.4.-.7.1.2.9.-.0.f.0.5.4.7.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.a.8.9.3.3.a.c.f.a.9.a.c.8.7.a.0.f.f.a.3.b.e.b.b.1.e.c.d.7.6.f.0.0.0.0.0.a.1.6.!.0.0.0.0.d.d.8.a.e.e.6.2.f.4.4.5.d.b.5.6.4.9.8.4.0.f.9.f.f.b.8.c.b.3.3.d.3.0.4.2.5.4.f.3.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.y.g.m.2.m.X.U.R.e.Y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8BF6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:52:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	62028
Entropy (8bit):	2.3396318094818365
Encrypted:	false
SSDEEP:	384:ODFNFlTvHoeFBFaz60FWPF0WTAGC/fpn1NwR:8DFlTvBFaW0FKFbClW
MD5:	974ADD2AFD022C93D8DE356BBC42845A
SHA1:	AD41478A51ABDB613B0A951696586E9EBD78BA70
SHA-256:	F770468022ED44C11223CD40F5980612F04080040E0059F96155D00F3E169F43
SHA-512:	6A85703E58C761FA83FFA453DD65358E3EE4234EC3CD36BFE1AA2279CC3B2336FF21F2C662543EEC267CCC6EA3D4F50E5F8353EB33849EB737F0C856899B875B
Malicious:	false
Preview:	MDMP..a..... ........%f....................................$...l...........:0..........`.......8...........T............!..T.......................\|...............................................................................eJ..............GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D6E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8434
Entropy (8bit):	3.702862838540738
Encrypted:	false
SSDEEP:	192:R6l7wVeJiPHk6HF6YEIlASUtZgmfsEpBJ89b2CsfmSm:R6lXJIk6l6YESASUtZgmfsF2Bfa
MD5:	67229C66850AC1B511E424D69E699975
SHA1:	B462B81976314360715AA15CF33ABE62B7AC9F94
SHA-256:	2EAD7531BEFCAC03665C43FC019ACE52F259CAD25304E22EC92A05BE9551E7C9
SHA-512:	6C7B39342993136857CDBDFCABDE72E7A7DC005AA3461903690C3A1A31FDDAC836054BE264FC1F89E7A673400921DD504EB12C2D7922AE84943A08D4AF898695
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8DBD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.4873148240263685
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYThYm8M4JdNHFl+q8v5N5VPDqId:uIjf8I78w7VeAJdNK5jRqId
MD5:	FD77323AAE1661277399B444D228CC2A
SHA1:	7F559311E80C35853C01544598482510D5D41730
SHA-256:	E9112B674B21C8962BEF9C91A2EE96A088435FB1C931C4B3FDB82AA326DC0129
SHA-512:	EBFE1AB4821B72ACC909F766E224020FB8B353CF2E63A04E6D69A4D7DB94921C7E3C5D3A3D15546055E32D5478E55C0F09F9572C897B48E7BD9F0E4A6D36A5B5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER93A7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:52:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	76108
Entropy (8bit):	2.400306530253979
Encrypted:	false
SSDEEP:	384:lQifXyDglTvLHx5RzFwqTul3t7lzF0WTAGC2qMawn41DW:lQqiDglTvjxfm9JplzFbCe49
MD5:	997644F12CB7205EAC242A2EC84AB677
SHA1:	43504DDBF5AB6890503E43E144C72726307512AD
SHA-256:	AFA5B83C3F0F2411822D42F894BEB06634B876C1011E9EEB3D67C9AAFDE616B7
SHA-512:	ADE8C40929E9874F03F1DD99532FC1798511131262858D6FED73B2E8C21CDC959F7D17BAF5D1103876C4E3678929B3CED6150A1253B42CF0379280349B3D38F9
Malicious:	false
Preview:	MDMP..a..... ........%f........................l...........<...t.......4....4..........`.......8...........T............%..........................................................................................................eJ......4.......GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9473.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8434
Entropy (8bit):	3.702537291890983
Encrypted:	false
SSDEEP:	192:R6l7wVeJiPI6b6YEI7SU8oZgmfsEpB089b/CsfrVm:R6lXJN6b6YEUSU82gmfsy/BfU
MD5:	192BC9B20B952C9DA212596D94ADFCA7
SHA1:	58F02BA91D0049CAF8242FD8FD703C8300C4A781
SHA-256:	8C4F735F4907CCC41A1207CFC42B2E0E37D73412B8B617895BF7DDD4246F3E97
SHA-512:	9376A2AF290E2FB041D62140B29CB74ABDD191959B4D9DB0D64A5D43394489402BDA21FAF92975CAE79662F9B7ADCE37A3B1F797C1077268CB78EEFB5ED267F8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9493.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.484512517881107
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYT8Ym8M4JdNHFQ+q8v5N5VPDqId:uIjf8I78w7VeZJdIK5jRqId
MD5:	53D03F18B5605276057E14804AD48E9C
SHA1:	0FA8D774DA5819EC126F5FA65906A405047FB306
SHA-256:	B65CC501868974E0A0F25FC3AE2ED8585F3D68DA485A7E388A6A2919DB185F62
SHA-512:	8B857600A9F4919F89D209C97CF0A84177C27B9F993F07DB724214857443813C76C1355FEBF22F0655DCD3A5AEBA5E130E68DC910E6DA0A4004F86EF2893F8F6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9656.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:52:56 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	87578
Entropy (8bit):	2.2686825266320723
Encrypted:	false
SSDEEP:	384:TQA8vFwTblTvJv0nRzsnIY0Biq7lzF0WTAGr/qjeCHXk9208sx:TQA8v2flTvZ0RUIDMQlzFbrqH0Ys
MD5:	778F6A6AE4F015BFADC612E7E323B31E
SHA1:	89E1D6627B2DD163BA8526C02185B7CCCB254725
SHA-256:	08F1F1D2C842E3D80333B6DF77B3DDA4E3FCB7E7AEC0E2AF3689A638119F0438
SHA-512:	7E3B58EABA5631EA8BB1D39810197691A744256BCBB04C495C0CD16AAADD386D6689EB601BCF1A87DC2A5EC6A29C7069F74C6778DBEF419F541D72E486D5C845
Malicious:	false
Preview:	MDMP..a..... ........%f............T...............h.......<................<..........`.......8...........T............&.."/......................................................................................................eJ......D ......GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9732.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8434
Entropy (8bit):	3.701322191091698
Encrypted:	false
SSDEEP:	192:R6l7wVeJiPc6UC6YEI7SU8oZgmfsEpBa89bECsfysm:R6lXJ56J6YEUSU82gmfsAEBf4
MD5:	AB1B4A2820BE5C01440BD6BE64F730EC
SHA1:	A5A508F9F93A40297794C87FF7309BB796D33AE0
SHA-256:	F97F0A06CE54C6EE6C5426A58C406C7CF32D53C0963E7A274CA54C5BF359C42A
SHA-512:	4FC252C5037D2CCCE1A7DE8F1883BDC4961E6D90C3D1099F46AA554DD77E871C64BCC203D2B00178CE50587FA4FBD1CB8D56F78101ED224DA7E0E719D4652F3A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9752.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.487337119069883
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYTRYm8M4JdNHFT+q8v5N5VPDqId:uIjf8I78w7VeQJd7K5jRqId
MD5:	287C213E5AE01270268F1743BC2D8B42
SHA1:	286529F615377387D9C4E20CD583B86A64F3ED43
SHA-256:	BF80C5A120D6CCDE525856BD14AB958A98DB2543F34157F0D9A8F09B56C08B33
SHA-512:	C1A746750C3C09CB1B34360580A4764FD6D8886EDE17A74585C21A3FF499B1B9C9F61EBE5F77C048D9950F400668911F58E6E5F64F1075199FF7B4E6B127875F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9954.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:52:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	87154
Entropy (8bit):	2.2816938289255897
Encrypted:	false
SSDEEP:	384:vQmkvFwT0llTvHRPARzvCFdq7lzF0WTA/CaAqkq0mZIxMD8DIQ3:vQmkv2gllTv9ujmQlzFOCawWIxMQ0O
MD5:	2942DB1C690BD81975F4EA533B49BE37
SHA1:	50F3FA636A97B1B203E4E66CDC9C37C48A560FDB
SHA-256:	4FDC3E6B1FF393853E908DBA6D6F5E9131ED44475393636674BE482D13D12216
SHA-512:	DCE3AE4E4732B7C812C71C5531CCEEBEF8D8562A8E4576F72ABFB97C6DC0526943B345C370EFD3103CF98BD17A0C7D1A8C7A050EE82FECD88AB6942CF522A039
Malicious:	false
Preview:	MDMP..a..... ........%f............T...............h.......<................<..........`.......8...........T............&..z-......................................................................................................eJ......D ......GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A01.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8434
Entropy (8bit):	3.700849158369179
Encrypted:	false
SSDEEP:	192:R6l7wVeJiPt606YEIZSU8oZgmfsEpBP89bNCsfivm:R6lXJI606YEWSU82gmfszNBfz
MD5:	744B1F0B6462EDABA899CD9067C9F7E0
SHA1:	8DE17778548A38F9606805981CDF7E047788D67F
SHA-256:	35BB21FAD993DAE2EC883F4385A488C5052141797788A9671F8ADE1326B11CD7
SHA-512:	B6F21F451DB3FCAA81A3F90516945E520A26625CE68808926544A3C1F2D8B0FDC30CA80803FB8AEB27CDCACA990E71BAF299FCEAA4C8C002B2ED14F39BDEA0D0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A40.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.485468830421247
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYT0Ym8M4JdNHFvw+q8v5N5VPDqId:uIjf8I78w7VeBJdHwK5jRqId
MD5:	7F115129F40EE8476FAB275D64F22E72
SHA1:	0974CB21A86D564FF1520EA23D2281B23A310864
SHA-256:	49A5DB8E23581BEDC7A9D6F6DADFA6E55A77E7A18E6A2F0D659E625CFB8BB77C
SHA-512:	9837A4CEFCEEEB2FB0989C3CFE3765D4A6DF232B10E0D6BDA26F93A92DA80ABD0A8E37B7F51CEC9A2978076AABEBB2B34E74E908CF1368ECC2790FE3241C7596
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CDE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:52:58 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	100820
Entropy (8bit):	2.3533977183872405
Encrypted:	false
SSDEEP:	384:jQmV0jX3lTvuW+RzWCoFrYy51xq7l9pF0W5AGrBUqIq+jhA8KE1Wbs:jQmazlTvZYysy5nQl9pFVrQjhAEN
MD5:	51DFDADAAAAC26ECCC1CAF7F88E2583A
SHA1:	095751F106E7F0EAEE3532F137CCC359C669F953
SHA-256:	677BBB09DE4134E2CEBBCD3AD39137E4F6DF0B1E1B93BA47DF32E93F9E7D1FA1
SHA-512:	E8350D5A6BDAF4E66B4FFC20CE1BC06E269444C7894197E19A3DFBB0AEEE45C1C9286524C1B82FE4B9C4B80E7EB996464622E70F6F66ACD63368B0BE4ECF822E
Malicious:	false
Preview:	MDMP..a..... ........%f....................................<................?..........`.......8...........T............,...\......................................................................................................eJ......t ......GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9DE8.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:52:58 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60740
Entropy (8bit):	2.326926348718114
Encrypted:	false
SSDEEP:	384:P+KkD3lTvF7gq7dUD9L660FvlKW+AGRwe/oT887:mHD3lTv5h0Z0FvlMRNoT8
MD5:	5095038249865F0B37F265DEC11B8419
SHA1:	BECE053E171A2BE079E49944B563D1DB154B33F2
SHA-256:	CD9E4388D28D10BA1A7E92AB3001A8C54E0735DC900CD4A2D5DA1FF530E7D101
SHA-512:	A07000C82A97AD6F048827B2726F1B1FDAD9AB6F31F99D1DA25B8890FEC9474EB779DF72A3C25CF6E300229944BA5E43C1508FA9740C849154ED13E7C4846B41
Malicious:	false
Preview:	MDMP..a..... ........%f........................(...........$................/..........`.......8...........T...............\|...........$...........................................................................................eJ..............GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E36.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:52:58 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60344
Entropy (8bit):	2.314623713595661
Encrypted:	false
SSDEEP:	384:1R0ExBTvPSnK4MNt0Ftm4LAsKY3DIjD2G:LdxBTv8K4MNt0FtmGKYMjD
MD5:	153A54CDB5516226D22428EDC04F7D65
SHA1:	39DB92CC95F600E4F87AB1928126563DD1DEAF20
SHA-256:	AF4BA3C531D41B566CDDBA2CF8EADACC388FDEEAD28AA081B67531CF5AF99B85
SHA-512:	762D98A8B76F2EDDD85E668CE3DAB72F8AA1CC30CF4FC93B571DCB8E10330056FA38443A3011B5FDA2708FF2B32C560543D9A122D30108E45F9805D9D5726B29
Malicious:	false
Preview:	MDMP..a..... ........%f....................................$...............&/..........`.......8...........T.......................................................................................................................eJ......<.......GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F02.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8434
Entropy (8bit):	3.7030612860634475
Encrypted:	false
SSDEEP:	192:R6l7wVeJiPa6j06YEIASUNYgmfsEpBT89bKCsfsum:R6lXJ/6Q6YEfSUNYgmfsnKBf8
MD5:	74607F07AFA851FAD333CF409C735EF5
SHA1:	4D7FB2BFA33ECEE53E52DD79314F18B71488CEDD
SHA-256:	FB691353475870DC43B795C983180713D7DB26415465E9B31494A945FCB98BFE
SHA-512:	4C860BBD4AE7EA63B37B554B4A11A8BBA214DF8D879D8786ACF48108F4EFA6A9B83797D3C13DD4426015DC8FC870A3CA9AD7D1ED3E8B43F143BEDF202F5E5833
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F60.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6400
Entropy (8bit):	3.728455288239234
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbrus6zcL2Yv2n/FXk4FgaMOUr89bKjRasflum:R6l7wVeJrus6QL2YvGEpBr89bKwsflum
MD5:	C340CD95F57976DC7BC94CE1C1ABB03C
SHA1:	ECE8AE31802EEFBA0106127125923EB25F599339
SHA-256:	16E8DECDA4F8BD4853F1C0164B6FFEE26ACE5E299D0533DF7B4D6A4F4CD985CA
SHA-512:	786E4FF363A35BA887762B62D5F373724BA19415F06B7E5E1F89BEC45729EAD954C5EA03487168AD8CCAF18D5EF6B10EFF54F404588DFDAA639245BE58A3D3D3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.6.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F61.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.488202318004578
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYTaYm8M4JdNHF9p+q8v5N5VPDqId:uIjf8I78w7VeTJd1pK5jRqId
MD5:	13DB05728955E69A79733EF29DD6A223
SHA1:	DE924DCF17ED7CFD6A3789DB11C5DD57568A5973
SHA-256:	4B49E2716565D330060B5E5E7C9FC575045E305CF846CA4DB43044495400493F
SHA-512:	45FDC109E177567C29F89AB90EC5CFDBDD33BA0FD3562C69419EDA0FEACBFEBCE6CCAB1C3E35C379E4654E7C4166BB9AC3F7921FDF6AF5E988F69385AF79B08C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F6F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6404
Entropy (8bit):	3.7274778134652173
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetb7uj6obGYv2n/FXk4FgaMOU089bK/sfiQRum:R6l7wVeJ7uj6oqYvGEpB089bK/sfisum
MD5:	F58FA056EDC0DC690DC929CF4DB1CB25
SHA1:	9F20BACF4757BA87BBF138FC4B845ACAB08F2745
SHA-256:	30B8D31BCA5C9BC2DA646DDF04C0943F295765C5595A7A89A1DC3B975519439D
SHA-512:	A239A1757FCD7C54B7E1FE5FCAF58F64F18874C3899274B810A6C0BFDA085CA73FDF8DCAC898F0DDEB1A99F6D8DBBEF3F4426CDDB781331882B42ECAEDB88C79
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.6.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F90.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.487035546374169
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYTUYm8M4J9NHFp+q8vHNB5TgJnMad:uIjf8I78w7VehJ9RKHv5TwMad
MD5:	5C24E4CF560682E496C4266C151669AA
SHA1:	D801AC4BAB03BD59E02BB7013B4C482B4800C28F
SHA-256:	7CBEE5B77DB9489755C74471767F5476D1C56B969C202E0E5CB38C52981AD6E7
SHA-512:	E689845EDEFFCA12010ED7755C1172EBBA35738FF0C5946FEA90F564A5E0E6FD7E4B7F4732E71373320CC661696CE5C490A96D38FB0691087037397CBFA0FA54
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9FAF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.485704216725901
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYTwYm8M4J9NHFv5O+q8vHNqTgJnMRd:uIjf8I78w7VedJ930KHcTwMRd
MD5:	29FEA86C320EA37538B51949D13FD5F4
SHA1:	2D51B9AD1B206C4D5A62F0AF0EB03F5B4DCCA632
SHA-256:	A6DF3BC3D021FE9C5890D017276BB9D39B21B5CDD9462CFAB49E66A833300B99
SHA-512:	2249666FF3FA194A66F0DDF12670C32BCD3029DE5FBC3445A16683A712C0F2493050B931A6DA1E3AC5BF7AE82311CF728A54B63C4BDC00B808129E13A79C7CAA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA376.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:52:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	111616
Entropy (8bit):	2.3324828955389165
Encrypted:	false
SSDEEP:	384:duQfx4oRslTvPZJX4RzS1WM5n6A7LFqqAKRqTlFpF0i5YGrB8qdYRiBLb2//Ss3r:EQfSXlTvHm+1WQlAcwlFpF5rHBn6ai
MD5:	0E88AD0EDD7234A41732C9B681D7DF40
SHA1:	F943BD1A26A287BE8C1F4A090730C6AF798F6267
SHA-256:	E20649CD0C02248E09DB63E61D32CDAC134DD3F5145835F9E35663A148C2B276
SHA-512:	4AF63E051B67D5468FE5A0C8CF7129B087C0B947A00E2749CB46850D0F030F4024248E68DD520EE17C64FF5D59BD9855B4C27D74F1A5D83A86F8271522892D97
Malicious:	false
Preview:	MDMP..a..... ........%f....................................<.... ......t...fF..........`.......8...........T...........`7...\|...........!...........#..............................................................................eJ.......#......GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA451.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8434
Entropy (8bit):	3.6998839306238227
Encrypted:	false
SSDEEP:	192:R6l7wVeJiPN6x6e6YEITSUSygmfsEpBG89bWCsfsym:R6lXJo6V6YE8SUSygmfscWBfI
MD5:	BD918F4E6900CD45C770ED0496D21630
SHA1:	BB82A3D9C047F4DCF7AA733C8D8A43E77577919E
SHA-256:	6335B34836EC46033495725575A7A9FBF3BFC1EA79BF589430EF6ABFA63FABC5
SHA-512:	5A64FDEF59BF4B369DFA1FFF637F4C85354DF155DE6C3F9C8A383C6AFE87BC0706424C413D90559B4832A44ECD7CDC16C60D9A4E7CCB78F0556C59E6774A14AA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA481.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.4862339225276235
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYTUYm8M4JdNHFx+q8v5N5VPDqId:uIjf8I78w7VehJdZK5jRqId
MD5:	E6CEB6A7E3957272F735765730AF50B0
SHA1:	5A13FAC678C099CABA8B2416F11F1F92D9645B6A
SHA-256:	73F76AB4F068A64254CA2AA84709B31BBA96A3187CA6974BEAE43120DBEEFFFC
SHA-512:	7D56CDD4ACEF904F74B3F7110571FA3643C36F427E2E6058E66A489B54886AA378F7992EEE025CDB3C54A390A05F0AC3589619AE8E3CA317B24BAFA8FE5851AD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA5D7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:53:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	80298
Entropy (8bit):	2.3069676596027566
Encrypted:	false
SSDEEP:	768:j9k2BTv4PmcN3h81rX3EwKl+mGKydrn5:xLAPmukrX0woGBrn
MD5:	B4F3F950F7C571E83DA55EF1F3D22940
SHA1:	899F7E140F15BD6A786AA7114A465A8FC6D771DC
SHA-256:	06409A6B00844E38371EB3A6AC028A203A78792A87B8F2E352C0F0A9C1FDFBA9
SHA-512:	34393C3341950FB590E2B9D31E875B7C5D1E3725C0070106FCCC17E9B0775E0F7B8CA26A5D7CD2EDB95A1BFEAECB04DEFB04A8D8983A8A15C42CE434CC250598
Malicious:	false
Preview:	MDMP..a..... ........%f............$...........D...8.......<...\|............8..........`.......8...........T............#..".......................................................................................................eJ......<.......GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA720.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6400
Entropy (8bit):	3.7245592850846876
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbruX6eLgYv2n/FXk4FgaMOUj89bWjRasfpym:R6l7wVeJruX6eLgYvGEpBj89bWwsfpym
MD5:	94F46513DEF430F198DD1962DE65B258
SHA1:	6B3B19D1014AE04D4637BBE46AF1CB28E3F0FF93
SHA-256:	5DDBE2A43A9CE8A9BF6C29EA0A6A99E73C8C6F6E5104CA5065310B0CF7350D31
SHA-512:	6F2E0B41F179A818E7DA2B9CC183131F50D9678FA4A32DDFFACE47BB9FC1689CA5C94EC9E3B64AE06A096B28AF10C6D6549250445A81B77AE2C878FAF4C3C3A1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.6.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA7BB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:53:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	75496
Entropy (8bit):	2.4082990406161318
Encrypted:	false
SSDEEP:	384:HjXIpMNlTvgNPhN6WwLerr4PlIiH7l9lKW+AGRIR5cqpdvd:Hj4pMNlTv+PRhrr4eibl9lMR2cqpdF
MD5:	ABEB632442A72F4655ECAEE603C334B8
SHA1:	B6AFA7B9B7484BA97DF3FDA4ED4B588AE2963895
SHA-256:	BF0655A5D025C9C8EF40CAC90F88F4A1B321F9B0F528E80D1E879A3677B71A39
SHA-512:	15D83840387E6B12DDA5FD94CB449B20C9829420876671F41604088CC200B6884F1095D5EA09D58BE6710F5670D7CC101FD19B900E5DC080D7B4E6DAEEA592A7
Malicious:	false
Preview:	MDMP..a..... ........%f........................l...........<...t.......d....4..........`.......8...........T...........($..........................................................................................................eJ......4.......GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA7CB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:53:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	116444
Entropy (8bit):	2.2614410645822547
Encrypted:	false
SSDEEP:	768:fQXeW1NIlTvjY7Y3o/wlFpF5rB0MKxwr:f/aM0ESOj5N0MKxwr
MD5:	C71233BF0F4DE549BD44D1F63C08E1CB
SHA1:	CD59610AFB4F6191256727ED7D63AD120F59CFE3
SHA-256:	9987343D02E153ED03E0FBB04D1AC4E31FA2788F0D6B974A2FC20EBDD59CE030
SHA-512:	ED6F130E04475B77A5EED0944EA03380BCA93B66090574B6B15D150E1877FA6C8E2448DF2CE2CA6F52F9EC21B9D047AA19BA9CFB387E3C0C5DB39197CA267A84
Malicious:	false
Preview:	MDMP..a..... ........%f........................\|...........<...t!...........I..........`.......8...........T............7..,............!...........#..............................................................................eJ......4$......GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA82B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.483397598464916
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYTMYm8M4J9NHFQ+q8vHNB5TgJnMad:uIjf8I78w7VeJJ9YKHv5TwMad
MD5:	C462EC791158E23A3A40560913A5211B
SHA1:	7C053047C777B00ED58ECCAF9BF0E3B43E0AF876
SHA-256:	C21953EE76E849F63254ADEB8A633A7948852BF276326127F9A3FE55BFE5B8E8
SHA-512:	C88E1B92D1C408F3E621097EB884D482F01366ED784D90B546EB1A707F233B3A985086EB349EA24BC7EFFA1E9F218F821B47289DFBA157D3EBF06C3ECB1C0448
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA924.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8436
Entropy (8bit):	3.7018085251760318
Encrypted:	false
SSDEEP:	192:R6l7wVeJiPj+676YEIXSUSygmfsEpBJ89bfCsfz1m:R6lXJU+676YEYSUSygmfsFfBfs
MD5:	27012439AF8C5C3720E14F7BAEA54A9B
SHA1:	A2E4B8942B924FCF3A3D34577CCD76D4BF662F94
SHA-256:	BA6CCBDDF94C10BADC547A7543CCDB717D5866F0DB3118D5A4905D2D254B1FB7
SHA-512:	1E1197EA793742E2379FD8D3B2244890595C4926CF8872F6B898E51ABB8ED689617F050D897A88F00EEF8C4060D77CE18ADD30A8596F8041252929878C317D64
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA953.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6404
Entropy (8bit):	3.725052707293574
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetb7uR68YYv2n/FXk4FgaMOUG89bf/sfm1m:R6l7wVeJ7uR68YYvGEpBG89bf/sfm1m
MD5:	ABD1E8120D365A13BA0F1A9E5A95945A
SHA1:	1D476C1CB99E0DD086213F78B75B3669D904AE12
SHA-256:	38B7CB512B4B28AE601FD28986C6499F0A6719F3B667A83D9284F624B8C5C021
SHA-512:	E6856B306BDDD4755786B5B22FA8FE0F65D1F0A98512D322A0E5A520A1D19AF2CD9CF0E52E8A9F5A81C960686E63281A216B2EAD8EC9FC70178D546B758EE587
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.6.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA973.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.489505718006816
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYT4Ym8M4JdNHFHH+q8v5N5VPDqId:uIjf8I78w7Ve1JdPHK5jRqId
MD5:	EC6B002DF7C9710B4B63C1C48A59584F
SHA1:	53DA84DC387DCEAF1D2B4AA0E8F077F5C717899A
SHA-256:	A2DABA8B92A9F8FE6FF1576DAF9D7BDDEC6EB66B86EA90DE0A61C13ED1B2DCC3
SHA-512:	CB2984278615F5257303D1FCCCC23E36FD0F1BB745725622A6EC438FD998EC2D0E4709B6A784D6FC2E171875FC20AE37C16B3A3D55E8969C3B04719242CF7BED
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA983.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.485146556167968
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYTcYm8M4J9NHFe+q8vHNqTgJnMRd:uIjf8I78w7Ve5J9mKHcTwMRd
MD5:	6C01C2BF9A38ED5D06169AFFA0472B07
SHA1:	190A7B0CE11B3D78ABDBE99D2C25105152FD93F1
SHA-256:	BB39C1825168565BE30DEBFA2ACA5E9BA79F60386C7D63088CFD957980C145C3
SHA-512:	F067C9A50C3E030ECC906EEB5AD2C44D9D6E63A389C129ABF4D8560B0F65E4994E128172A6D1A1599DC89618F35BBF36AA782D906DC5ACFB2D62CECDC6679E63
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERACBD.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:53:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	85894
Entropy (8bit):	2.2452816313376855
Encrypted:	false
SSDEEP:	384:pOUQQsZ7bBTvkzb6/lXdLgEwKl+m4LAsKMNyOFllWOX:pn1+fBTvkytXdUEwKl+mGKMlRWu
MD5:	2C3C6C4842D26C98A74DBD13A3878BA5
SHA1:	E122A6BB6790BA1BC32DFFDC60AE14681724D043
SHA-256:	F82996AC19F579C2022ECB2BA561126D3B4BE8ECD81C7F876EFB21DBAE8E6765
SHA-512:	11FAD255485DC7CA227D41D3C9F677A1DB8A46C1288BA8A364E83966686436A07D7B2C3FA7B7F902590C01109700515716A84B6D960180D77FA74572556E9CDA
Malicious:	false
Preview:	MDMP..a..... ........%f............T...........D...h.......<................;..........`.......8...........T............#...+......................................................................................................eJ......l.......GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD98.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6400
Entropy (8bit):	3.726963333663136
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbruS6YYv2n/FXk4FgaMOUOx89bkjRasfBMm:R6l7wVeJruS6YYvGEpBOx89bkwsfBMm
MD5:	FBA7A5CA9BE9D861F78029278E94CEC4
SHA1:	2A9F764233B140C5C186D5722E6DF4E16801694E
SHA-256:	CC17A89FA9DA0B5F982E07255C5FF01623803A020F8D4B99226FF21459F10FDB
SHA-512:	7923474FCE4929E4796799BE5F35FBFDE526FD14CE64F0BAE866EFF26F1DDCDEBBBBC145F042E00CE185E0C1320240E38E1D88E870347BCD834043D06B885CCE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.6.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERADD6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:53:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	81318
Entropy (8bit):	2.3688849520536674
Encrypted:	false
SSDEEP:	384:OLQZElTvpAl0662MLUZrGgl3RvnH759lKdBAoRyp5BpPMG:OEKlTvWl7TZrGivnb59l+RK1
MD5:	52B43079D90ECB3F1839804DD4D884D1
SHA1:	DC862639FB52F202B8AF3B28E7E6BA94B72CFF6D
SHA-256:	08276062F0218C45C195EFD67858EF77D8EB42A407BEA909A5955460FFEFDFAC
SHA-512:	E0DFEB2470C2ADF9FE1A65F2AEB34518DDF8AC1668F85F9DFE5F90B748C267508440A8C68DF6ACDFC6417091498A09198F5182ED2655808BF88D7B4D9CFEC163
Malicious:	false
Preview:	MDMP..a..... ........%f............$...............8.......<................8..........`.......8...........T...........x$..............L...........8...............................................................................eJ..............GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE16.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.484785052116609
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYThYm8M4J9NHFPy+q8vHNB5TgJnMad:uIjf8I78w7VeAJ9SKHv5TwMad
MD5:	EA643FF2E341D1FE75A1C7396513D5FA
SHA1:	9613C79D27A6BC5428D0370D82E938B349CE3AEE
SHA-256:	4FD942F10A576E265FB2B2EA3BC84C2D9CEBB14AC1AABDCB06BADC28704B92FD
SHA-512:	C90299A63794FD2A4E9AD57BB67D99F7C1EBD2BDD64867D06AACAC5429B6AA71204F6DD54335D35A96545B19A8BAB608FDDC56FCE3B8F17C3DE7766EC79922B2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE73.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6404
Entropy (8bit):	3.7263247221086844
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetb7uN6SYv2n/FXk4FgaMOUw89bk/sfAtvMm:R6l7wVeJ7uN6SYvGEpBw89bk/sfYMm
MD5:	84735122A9CA87072711C3B44FDDEAF8
SHA1:	2FF94DE95BDB4C40E550354070162001B199D3ED
SHA-256:	F0AE0360112FBF5C88F7593CD88149A82FA599D6B49548077A55465F59DC8166
SHA-512:	82AC262503098AC7C5A967A734BC3337DBE065273D455B764D2F09DBC3EC79994DC050088EB6D89C94BAD88413451B6887B904F871AEBF4D327B477DE3307453
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.6.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAEC2.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.486766807123678
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYT6Ym8M4J9NHFnUt/+q8vHNqTgJnMRd:uIjf8I78w7VezJ9IKHcTwMRd
MD5:	DD01202FC103160C0D4041A1C8FF9716
SHA1:	EB9655A86B936737F4CA75B4215C38DCD86658C3
SHA-256:	64D15D5670CFBC6D259293D1BAB3214D6478C7F13511F1437387A4841D086553
SHA-512:	8D5727512D03E28E4AE7F89B502C841CF19E22601FD9798D59E062B95CC25DFB3CD91294EE060B0F43EB32210C8984830F756C5F7460E0BD6AF0CB121950F070
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB141.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:53:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	99454
Entropy (8bit):	2.3224369085069023
Encrypted:	false
SSDEEP:	384:qjjGA78yLmBTvvPJT3ikbuXAeFpwKl+m4LAsKI+Tp+u7wQL3EY:wjGm7LmBTv35iZw4pwKl+mGKIY7zL
MD5:	8C7C2DD411017BFF5AE28D37360EB678
SHA1:	44730FF2240F7E88859F7CB4302BDE86DE8D3655
SHA-256:	551A063D67F05B5F80485F959D3218C458384DA1CFA8DE5CF34FFAB4FDD37A8B
SHA-512:	90309B883C8A9C0CC16555C3C87C189F3CCA0363A0CB347426B2246C02A2FF946D2C01A46547275D0009BF8264B32A1DD9B57B72E52B70E2AB702FA2C8F7093F
Malicious:	false
Preview:	MDMP..a..... ........%f........................D...........<...........$....>..........`.......8...........T...........P)...[......................................................................................................eJ..............GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB1DD.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:53:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	85886
Entropy (8bit):	2.263815192442
Encrypted:	false
SSDEEP:	384:qJvxckLxlTvAwirf6S4L2GnH759lKdBAoRq1QqMCaF:CviSxlTvXiNtGnb59l+RqrMZ
MD5:	07383D747120836AFB81312F96EC2F21
SHA1:	B5CC2A635C77666F1661AD7D155B2CFE6DC6E38A
SHA-256:	AB649C96FA136E40A5F7D7107BCE12A510C52613B81B4B9D598A32C9A5B67668
SHA-512:	06240F6A4F03EAD4FBB8019694A6A33288642A01037EBD8A5CB92396E6DC2CD4009A9374B396176B680EB21DC0E392A89C8750E1560A6057599227F5282E92FB
Malicious:	false
Preview:	MDMP..a..... ........%f............T...............h.......<................<..........`.......8...........T............$...*..........T...........@...............................................................................eJ..............GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB21D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6400
Entropy (8bit):	3.724630785607503
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbruk6lxx9Yv2n/FXk4FgaMOUt89btjRasfvPm:R6l7wVeJruk6bLYvGEpBt89btwsfvPm
MD5:	24C571FAF91646736D652C004AFC08A3
SHA1:	B25395505ED0130197FF1DC8085071B81463D2DE
SHA-256:	536B5F42059FCB73726E82AE84BA85179FD69F4D3549E2F2E7247A4B9E0707B4
SHA-512:	7C125BDC1308A26D990C3FA465B143A3BD2717A1044125C60DF53A0D7F12A2681B24B00E59D23CCD0C27A6EBE2B68DC007DF276A42E1B2D71CE16F4B9A9EDED6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.6.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB25C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.4836396373901275
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYTOwYm8M4J9NHF03+q8vHNB5TgJnMad:uIjf8I78w7VeOdJ9s3KHv5TwMad
MD5:	09E2AC2427CDA10E6E8148D73CB0CDC6
SHA1:	C0593924952FA4E700E16F9DDCD48CA57A6B9C38
SHA-256:	B233DDCC1098371B240F631A1F7031073EF4F1CB5C19D9F5F5493F7253705EFD
SHA-512:	00E91AD5E641A2E2ECF95E6690FAC55FF562FE0A95E01EBC95F73238FFA278E20A1CC7F2C7FC2188038A286F2337642915EA8E9CAF9429BED938AC09F1DDAE94
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB365.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6406
Entropy (8bit):	3.7252284072874993
Encrypted:	false
SSDEEP:	192:R6l7wVeJ7ujg6QfYvGEpBQ89bt/sfx7Pm:R6lXJ0g6wYu+tkfxa
MD5:	783C1B1D01BDCA2A0F2A0EF151C49209
SHA1:	96E26C23CC75B4852F7CDA3F8AA6ACB8FFCF25C4
SHA-256:	BD68C0C975621612CF92219097D41DEE42179387BF183DECC8A3DAFEEE76C296
SHA-512:	E895DE8362943D9AC170AE8D2914FE931AC7A6C444C5CE0BD79626C4B7455B6B5E0BE17A13843C7B61BD8ECA73235F8A3A16DFCCD91126E3AEE711DCCE92995B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.6.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB395.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.485565856210996
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYTXYm8M4J9NHFK+q8vHNqTgJnMRd:uIjf8I78w7VeKJ9CKHcTwMRd
MD5:	5D555A6F79215FE604211C79B677A82C
SHA1:	C870B334154A993966E055D612F658CCB73511BF
SHA-256:	1B99F76CAB26A203BC298C83AC71FA076C8042EEB675A7EB58CDCC84326E5F42
SHA-512:	A473FC4A4A4396EA39D068075176385C4D127BD68003A11C0B7682528A18495A7AC97CA75BF153228EBADEBB34E78B7B2C8F45E18FA87EA44074A79120BC5980
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB577.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:53:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	101496
Entropy (8bit):	2.1847610690071084
Encrypted:	false
SSDEEP:	384:ze0hO3wUcBTv+xqzb+aTCPYj2yFpwKl+m4LAEKZQeJFcM41g:zecO7cBTv+UWdP8FpwKl+m+KZPF34u
MD5:	835F53318972E9F238B746F82DD20E4F
SHA1:	A4306BDA15A9187F8C42804B4CB5FE4FFA908594
SHA-256:	5972D9A74AE8CA16161EEC1834D196E6C0BBD6EF51CA7D325BC0B5E19EFF60FB
SHA-512:	EA006EE4CBB40A14FA5BE5FED0E2E4C97BC28BC76CD9F161E416A3FCD86C35C011BA4376308C71CAE669244C436A597AC2EB589DEE6FE766DAC19A62B0B613EF
Malicious:	false
Preview:	MDMP..a..... ........%f....................................<...x............B..........`.......8...........T............*...a......................................................................................................eJ......8 ......GenuineIntel............T............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB662.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6402
Entropy (8bit):	3.7246845422728114
Encrypted:	false
SSDEEP:	192:R6l7wVeJruju6GzcYvGEpBM89bywsfWKmm:R6lXJEu6ZYuKyDfl
MD5:	0219190D18C54B0737176AF588924C6E
SHA1:	687D69E2698CECFF352F843649A9FE4FA3B0EA13
SHA-256:	F5099FAF12164A09D07AA4149D30EF2F341D2787B2BF7DADA2C8E8D6D8BC7225
SHA-512:	338B97DBC750655C716430250A11043ADFE68AD88F666F960E173E0B3AA1F1DD42817662AE44313B3A074FCED4B1825C419E63490B81C2F34BC8A840628B19A0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.6.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB6C1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.483530091193038
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9OhWpW8VYTeYm8M4J9NHF5a9+q8vHNB5TgJnMad:uIjf8I78w7VeXJ9YKHv5TwMad
MD5:	02A62EB1D879FF10FE8BEF7AAFC5D8D8
SHA1:	6D51C1692CB9BF256E44A8B02EC072C38B269DDB
SHA-256:	3B8FA982163E18B95E2934B22719179E8399BEBFA035BAA2F54ABAB10B404084
SHA-512:	B8AF99D469CF3EDDDACAA5C27C664E76AC4FE327155940EC2A7AFC13A74C5AAA07F390756644F31AF2F061A4B3C12F01DA0078B8C76E45C5973F96704B0C7524
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	997888
Entropy (8bit):	7.765309926729777
Encrypted:	false
SSDEEP:	24576:opsnpECte4yQyGPLUXotoVeJVUXuJlt+ZPZzR4:opspbe3GPwZVeIeJlt+ZxzR
MD5:	D668244429E4A7A0B205B2CE843B9663
SHA1:	DD8AEE62F445DB5649840F9FFB8CB33D304254F3
SHA-256:	EF09750219F549D293572AEDB0F593EF6C4A74AC77BB99950CA8B5A91377AB89
SHA-512:	998A0CD29C6ED6B9D922E2A5706A0B9F661F4C9EC2D8F30EF942BBC69D42C8D30938297D81123C6F2B312F5F09E81E08BBC38B944A563E4D0B7B17BD28DB2438
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37% Antivirus: Virustotal, Detection: 39%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.....\|...\|...\|.......\|.....z.\|.....*.\|.......\|...}.v.\|.4....\|.......\|.4....\|.Rich..\|.........PE..L...9..c.....................t......]@............@..........................p......C........................................j..P.......X...............................8....................`......h`..@............................................text............................... ..`.rdata..0t.......v..................@..@.data................`..............@....rsrc...X............J..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\SZDEAvOWuc1j5blWLO4H6aA.zip

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	2902
Entropy (8bit):	7.75013991512401
Encrypted:	false
SSDEEP:	48:98afL8DZIeXWt/QLRGzkH4IMlhl/YX2gBMigpCPgM9n3KJ6Uk2OVJMw:B8D/XWtGRO2fMlbQX9CQY43KJWn
MD5:	575531A71490D3CEBEB6B2ADD857E06D
SHA1:	EC86722D1446095A5CFAD60EED64CD0A7A181EC2
SHA-256:	592B03F0D792B295822D295DB6D6EBF59E83209259A494F997091C48533F499B
SHA-512:	2ABA1ABF8B70CFDF21AB2B698AD3F064D3D14781F551B4E100EE2626B211F160A8AB8DF80B078EA57B510D3D17A218BE858D3A30D985288F9E5C2938B2EE20D7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\SZDEAvOWuc1j5blWLO4H6aA.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........X..E.............Cookies\Chrome_Default.txt....P.@.5.....d...`\|L2J1l.. .3."_..N.......q..b..=../c.;{.........4F8...0..Y.........Z}Y.g.<w3.f.W(....K.o..l...!.......y.o;.F..5%.....\|0MS.....J.,....../.o...8.H...,M.......;.....I!.z.W....j...e....fE.?.X....6...g...skL.K.85b.U.5...[/.<.h....C..\|...C5"{..i.$...'..W).f.O.i..4.....L..Z..t.Z(].2.m.?..<....]........f..I3?.q..8U.6...8.N.y_#Vb...g.k?.Z1.!.3$.....\.%...PK...........XO...............information.txt.Y[O.J.~..........a.3.3QB`.}p.N.p..v .j...............UU.}.M.dH.E.>.{..."....^..5......lJ.9.l....)..q.....:$.aR/L8.}.....`.'.....E./.....y...H.....4...c.......j......_.wq.p/@..5_..3..da.6\..P.0j.D.....w..<...e.Ww_M.P.......5...<.3..MQ>..i..8.l....G.G..Yo..2.=o.m.I....Q...I.<.?.{..{..n>....Y..`...rt...e.e...@}.'.S5$....dR..v....Q..lkS.?.5.?..!...9.~>.9..Kc.~.5.2.V.,z&SS.......$.u.G.....6.\|0......E......u.....'G.<.MB...)..../...d.m......

C:\Users\user\AppData\Local\Temp\dxTuy4jPkMDKvqGzbwvO8nc.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	2932
Entropy (8bit):	7.7518906192798225
Encrypted:	false
SSDEEP:	48:93a8lnPtLe849QnPmn9EwDwr/Ojdw6KX+QIBMH9LgB56IrKN/U3nn3KJ6nkFOhww:PhWQnPmn9EwD66aWMBgB5VrK52n3KJa
MD5:	9F4E7D2CB39E0B6DF90AE6891E39F233
SHA1:	D0CE4B30152990370A44D921D3E863CB37CE0AD1
SHA-256:	649A61820E69031CC175392F5560232A922BFF1852E731450FABAB888AD7ED5C
SHA-512:	E3E1FD7D6CBCD5D32EE72FBCCDD08A3F22ADBA1EE60A7FA720CD882C254B031AA5BA7443B2B39CACA54D2DAC617A3DE1A6D6C0C0DB10ADAFA852E6F470D6171A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\dxTuy4jPkMDKvqGzbwvO8nc.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........X........$.......Cookies\Chrome_Default.txt....P...5.........`.L2J1l..\@.k.D..M'.t.k[Op...k...=..#T......?T...y..8.!(.h.>....o?.E.<.....EvWV.A....r,.4..\|...u..<..4..T..w..1....._V..a..jZ....qcY..:.T.I.................l9.u..M.n.Q.W..Y3..".i...N.....;.n....t..].\|-8\|....W..v.....If&xA,}.`+5~.....Yx-..3..><9.]K.)..in.. .H=.@..FEH.a..<...0.j...t.J,=>6..z.k.x...N...f.R.+.Y...~i.I..4.....p.Wm...5j.................tI..t.o..E....PK...........X..,.............information.txt.YmO.H...)........m..A..f&;Q ...j..`...@....+....G..RR]].T.S.m.t.f...}..~..J.\|H...{...6C2.rr......CN..\..Q\|......I=7. .u4.>..y...JP..?O....g...#!b_H:.,....3.b.....^.........F{..............B....Q.s...C2..M.bYF+...'..&....lM.wS...sZZ.Y...E......n.V.QvwmV.L.........8..x...I.<..........M...wrRgQ^.....rt...E.e....}.'.S5$...Q....V...Q.ZojS.?...>..!...>.z>.>..J.y....:..:....TE.i.0..-.2......&Z.F..F...W.</.2yY.\g.2K.{r4...$.k./.buL>.r

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.345851989338261
Encrypted:	false
SSDEEP:	3:L/gc:zgc
MD5:	77300B4E61394E6181367F5E3B73E081
SHA1:	F3D906CF9099782C12B88248A91BED0FB00C56D3
SHA-256:	5E91A4AB52806ED1F3E1B44FA5DADDF7327C608DBFD23D3DAE744943596CFC07
SHA-512:	8B85B0389E6655AE7DEF5604B5B33ECDC70B02383E451BDE607C595EF277C7136718A4AE4AF75327E5E3E660CB8CB7BA5C7BD4E86CC72BA29294861A3836DBAF
Malicious:	false
Preview:	1713747473789

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\10Pc6utWIKvPCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\3aqhlGTkMf6CWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\5ubzGmjuGMGiHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\BvIYddkfIBauLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\GSrU6tJI5jqdCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\HiTDZbYl7tFjWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\KmAexCJkC4ggHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\MRFQeKpv_Q9HLogin Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\OQfY1gqQGgq8History

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\V5xRcDusXlIgWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\cLPMQEK1PaWPHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\oqeZ8c0GMjOkWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\u7JVJIshcVUFLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\u95tGpwZki_XWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6AEw0M_IhkGZ\vJBq_maU8UdXWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\22YOafS9AuarWeb Data

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\6XPTC_VuRvwAWeb Data

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\9RXV5dQHO6wdWeb Data

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\AZa26iW7YyBCHistory

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\CmUnb0IC2w59History

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\D_PqPMh3t76fLogin Data

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\FsARZr9gVanTWeb Data

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\MEClXgzFtw3WCookies

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\NdZrHbm08IDPWeb Data

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\TMHi1BjWgM9QLogin Data

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\dZAi4cbdogK5History

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\e1b5ormmlkNOLogin Data For Account

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\ftgPJeedzDWiWeb Data

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\qdnEfTd8VGDBCookies

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanpFpfdi9cVY05\wlp36kFa8_U7History

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy6AEw0M_IhkGZ\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	5.999391385907715
Encrypted:	false
SSDEEP:	24:KauS79Gr4iSllJALQZ73auS79Gr4iSllJALQZ7c:KauS7GAfJUu73auS7GAfJUu7c
MD5:	C0ADF7485C183F86B6E5146BBCAD794B
SHA1:	1F31AF65C794F1C146C90F710035734C2D309AE6
SHA-256:	B9DE707D979A9939290146CBFD7769E6121A43BCCF04ED0731C6108F47577CE6
SHA-512:	E23D818BC20E47A8183F4B6AA2CE79B72CFF805ACC6BAAFCB009F372FD8F498522340EEC54621A8A219A8DCE019308137774ABFC35AE15941869B85BA7FA8085
Malicious:	false
Preview:	.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.TRUE./.TRUE.1712238015.NID.ENC893_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.TRUE./.TRUE.1712238015.NID.ENC893*_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpB

C:\Users\user\AppData\Local\Temp\trixy6AEw0M_IhkGZ\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7188
Entropy (8bit):	5.516763288086174
Encrypted:	false
SSDEEP:	96:xzglZRMlc2KBhA6tsxODsRw4Uxr5Z9aANUbg3x:x0qlX6tsxPHSr5ZlB
MD5:	C916FB1D183F9818E27B012FEEDE6580
SHA1:	3DD68460E2BA6CC36872146F40084031A42D96F8
SHA-256:	255494528B436D0872FDAEEA223A8E9503EA88D148A2D09368D9780C2C216B11
SHA-512:	A1529CD41A91F308B1A4BA08560202932A7CB0482E4A6CADF4A4E2C13FD787D1BC298102FEE089BD508DD95C2AF1FF4D4DFE834928463445EA3E7C72E38B0F51
Malicious:	false
Preview:	Build: mosik..Version: 1.9....Date: Mon Apr 22 01:53:20 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: b2021762f2b1eb6f19d126e2333b5b9a....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy6AEw0M_IhkGZ....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 965969 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 22/4/2024 1:53:20..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost.exe [788

C:\Users\user\AppData\Local\Temp\trixy6AEw0M_IhkGZ\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixypFpfdi9cVY05\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.999391385907715
Encrypted:	false
SSDEEP:	12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
MD5:	06ED2CD304730F55A5C7001509E128BE
SHA1:	49651485B2CE3D239172BD52BF5A265AB3EB8E18
SHA-256:	66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
SHA-512:	0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
Malicious:	false
Preview:	.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.TRUE./.TRUE.1712238015.NID.ENC893_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=..

C:\Users\user\AppData\Local\Temp\trixypFpfdi9cVY05\information.txt

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7146
Entropy (8bit):	5.514185322325561
Encrypted:	false
SSDEEP:	96:xzmJqpZRM4Wc2KBhA6tsxODsRw4Uxr5Z9+fANUbg3x:xVvqDX6tsxPHSr5Z5B
MD5:	FAD3B2EEA7129F04A469AFCB1B589099
SHA1:	1B9853052992F84C9772B2BB3FC3D39E5F485CDE
SHA-256:	207227A93D0B1E8D1B35938E53AE68C7F90C3BF0D4215A246E76E3DD0C089CF6
SHA-512:	BCCBD99C0D29A990268B6BFD020CBBAA4443341BC6A2F626165427225DC4B43C8424791EC99CD83A764E8CE7417DC681A87FBD290EFB06AF519AFDBC5FECCC35
Malicious:	false
Preview:	Build: mosik..Version: 1.9....Date: Mon Apr 22 01:53:13 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: b2021762f2b1eb6f19d126e2333b5b9a....Path: C:\Users\user\Desktop\ygm2mXUReY.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixypFpfdi9cVY05....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 965969 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 22/4/2024 1:53:13..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost.exe [7

C:\Users\user\AppData\Local\Temp\trixypFpfdi9cVY05\passwords.txt

Download File

Process:	C:\Users\user\Desktop\ygm2mXUReY.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.424438597755887
Encrypted:	false
SSDEEP:	6144:zSvfpi6ceLP/9skLmb0OTBWSPHaJG8nAgeMZMMhA2fX4WABlEnNz0uhiTwD:+vloTBW+EZMM6DFyF03wD
MD5:	91A322FB5AB4CF677840EA6E8B611539
SHA1:	5DE88E448A3D241A3E33A86E29AD2107D7756E53
SHA-256:	31CC57E671D11DEC85A8A96ED6C37B0B52C21B6500B444AE7D6878F6197E089F
SHA-512:	07BA50B2B33E396FF89A8A88FD44147D732E24E01A93C4B2F35BA96C4B458B0165FFB2F446FAEEA7658601252CACF1B29232DEE68133235ABC30F1FD51908AC4
Malicious:	false
Preview:	regfF...F....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm67..G................................................................................................................................................................................................................................................................................................................................................i.2........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.765309926729777
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ygm2mXUReY.exe
File size:	997'888 bytes
MD5:	d668244429e4a7a0b205b2ce843b9663
SHA1:	dd8aee62f445db5649840f9ffb8cb33d304254f3
SHA256:	ef09750219f549d293572aedb0f593ef6c4a74ac77bb99950ca8b5a91377ab89
SHA512:	998a0cd29c6ed6b9d922e2a5706a0b9f661f4c9ec2d8f30ef942bbc69d42c8d30938297d81123c6f2b312f5f09e81e08bbc38b944a563e4d0b7b17bd28db2438
SSDEEP:	24576:opsnpECte4yQyGPLUXotoVeJVUXuJlt+ZPZzR4:opspbe3GPwZVeIeJlt+ZxzR
TLSH:	03251312B6C59437F6B787308C744A51063AFDB26931891F6788F62E2EFB1E01A51F63
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.....\|...\|...\|.......\|.....z.\|.....*.\|.......\|...}.v.\|..4....\|.......\|..4....\|.Rich..\|.........PE..L...9..c...................

File Icon


Icon Hash:	cd0d3d2e4e054d05

Static PE Info

General

Entrypoint:	0x40405d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63FBEA39 [Sun Feb 26 23:24:41 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	43cb5d6ab6c623f5883f711e054621c1

Entrypoint Preview

Instruction
call 00007FE3B48F56D8h
jmp 00007FE3B48EFAA5h
push 00000014h
push 004166C8h
call 00007FE3B48F2C22h
call 00007FE3B48F47E3h
movzx esi, ax
push 00000002h
call 00007FE3B48F566Bh
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007FE3B48EFAA6h
xor ebx, ebx
jmp 00007FE3B48EFAD5h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007FE3B48EFA8Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007FE3B48EFA7Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007FE3B48EFAABh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007FE3B48F2A98h
test eax, eax
jne 00007FE3B48EFAAAh
push 0000001Ch
call 00007FE3B48EFB81h
pop ecx
call 00007FE3B48F2179h
test eax, eax
jne 00007FE3B48EFAAAh
push 00000010h
call 00007FE3B48EFB70h
pop ecx
call 00007FE3B48F452Ch
and dword ptr [ebp-04h], 00000000h
call 00007FE3B48F3B85h
test eax, eax
jns 00007FE3B48EFAAAh
push 0000001Bh
call 00007FE3B48EFB56h
pop ecx
call dword ptr [004100C8h]
mov dword ptr [040D796Ch], eax
call 00007FE3B48F56BFh
mov dword ptr [004E6920h], eax
call 00007FE3B48F52BCh
test eax, eax
jns 00007FE3B48EFAAAh

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16afc	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3cd8000	0xee58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x10200	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x160b0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x16068	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe403	0xe600	7b31db8089c16557734f35bf632d4c74	False	0.6020380434782608	data	6.68670617044423	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10000	0x7430	0x7600	85297e859433e8e12aa647e32015e4a3	False	0.3898305084745763	data	4.888708079319744	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x18000	0x3cbf984	0xcea00	e92ec5ec1663fcfac16166a2b8f430a6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3cd8000	0xee58	0xf000	5312b41c27b3bb1efed2d6246a08c490	False	0.47900390625	data	5.216986397030211	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3cd8570	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.4869402985074627
RT_ICON	0x3cd9418	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.5997292418772563
RT_ICON	0x3cd9cc0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.6532258064516129
RT_ICON	0x3cda388	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.6560693641618497
RT_ICON	0x3cda8f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Romanian	Romania	0.3912863070539419
RT_ICON	0x3cdce98	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Romanian	Romania	0.5086772983114447
RT_ICON	0x3cddf40	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Romanian	Romania	0.5860655737704918
RT_ICON	0x3cde8c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Romanian	Romania	0.6773049645390071
RT_ICON	0x3cdeda8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.4139125799573561
RT_ICON	0x3cdfc50	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4598375451263538
RT_ICON	0x3ce04f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.554147465437788
RT_ICON	0x3ce0bc0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.44942196531791906
RT_ICON	0x3ce1128	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46307053941908716
RT_ICON	0x3ce36d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4793621013133208
RT_ICON	0x3ce4778	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.494672131147541
RT_ICON	0x3ce5100	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5540780141843972
RT_DIALOG	0x3ce57c8	0x52	data			0.8780487804878049
RT_STRING	0x3ce5820	0x322	data	Romanian	Romania	0.47256857855361595
RT_STRING	0x3ce5b48	0x5a8	data	Romanian	Romania	0.43577348066298344
RT_STRING	0x3ce60f0	0x1e4	data	Romanian	Romania	0.4772727272727273
RT_STRING	0x3ce62d8	0x322	data	Romanian	Romania	0.47381546134663344
RT_STRING	0x3ce6600	0x698	data	Romanian	Romania	0.4259478672985782
RT_STRING	0x3ce6c98	0x1ba	data	Romanian	Romania	0.5135746606334841
RT_GROUP_ICON	0x3cded30	0x76	data	Romanian	Romania	0.6610169491525424
RT_GROUP_ICON	0x3ce5568	0x76	data	Romanian	Romania	0.6694915254237288
RT_VERSION	0x3ce55e0	0x1e4	data			0.5371900826446281

Imports

DLL	Import
KERNEL32.dll	LocalCompact, GetUserDefaultLCID, AddConsoleAliasW, CreateHardLinkA, GetTickCount, EnumTimeFormatsW, GetUserDefaultLangID, FindResourceExA, GetVolumeInformationA, GetLocaleInfoW, GetCompressedFileSizeA, GetTempPathW, SetThreadLocale, SetLastError, GetProcAddress, CreateTimerQueueTimer, FindFirstChangeNotificationW, BuildCommDCBW, LoadLibraryA, WriteConsoleA, InterlockedExchangeAdd, LocalAlloc, SetCalendarInfoW, GetExitCodeThread, RemoveDirectoryW, AddAtomA, SetNamedPipeHandleState, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, LoadLibraryExA, ReadConsoleInputW, GetWindowsDirectoryW, AddConsoleAliasA, SetFileAttributesA, GetComputerNameA, WriteConsoleW, OutputDebugStringW, GetLastError, HeapFree, EncodePointer, DecodePointer, ReadFile, ExitProcess, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, GetCommandLineA, RaiseException, RtlUnwind, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetCPInfo, GetCurrentThreadId, IsDebuggerPresent, HeapAlloc, GetProcessHeap, HeapSize, EnterCriticalSection, LeaveCriticalSection, SetFilePointerEx, GetConsoleMode, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, WriteFile, GetModuleFileNameW, LoadLibraryExW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetStringTypeW, HeapReAlloc, LCMapStringW, SetStdHandle, GetConsoleCP, FlushFileBuffers, CreateFileW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpConnect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/22/24-01:53:01.193897	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49708	147.45.47.93	192.168.2.5
04/22/24-01:53:38.322767	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49708	58709	192.168.2.5	147.45.47.93
04/22/24-01:53:37.276261	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49706	58709	192.168.2.5	147.45.47.93
04/22/24-01:53:24.660719	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49723	147.45.47.93	192.168.2.5
04/22/24-01:53:00.837713	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49706	147.45.47.93	192.168.2.5
04/22/24-01:53:24.890079	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49723	147.45.47.93	192.168.2.5
04/22/24-01:53:54.436720	TCP	2046270	ET TROJAN [ANY.RUN] RisePro TCP (Exfiltration)	49723	58709	192.168.2.5	147.45.47.93
04/22/24-01:52:56.197489	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49705	58709	192.168.2.5	147.45.47.93
04/22/24-01:53:54.436720	TCP	2049661	ET TROJAN RisePro CnC Activity (Inbound)	49723	58709	192.168.2.5	147.45.47.93
04/22/24-01:53:29.479123	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49723	58709	192.168.2.5	147.45.47.93
04/22/24-01:52:56.636815	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49705	147.45.47.93	192.168.2.5
04/22/24-01:52:56.389699	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49705	147.45.47.93	192.168.2.5
04/22/24-01:53:47.973422	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49715	58709	192.168.2.5	147.45.47.93
04/22/24-01:53:01.078051	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49706	147.45.47.93	192.168.2.5
04/22/24-01:53:00.350421	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49705	58709	192.168.2.5	147.45.47.93
04/22/24-01:53:12.584543	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49715	147.45.47.93	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 22, 2024 01:52:55.949357986 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:52:56.168751955 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:52:56.168991089 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:52:56.197489023 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:52:56.389698982 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:52:56.417090893 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:52:56.417290926 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:52:56.510426998 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:52:56.636815071 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:52:56.682198048 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:52:56.769901991 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:00.350420952 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:00.393048048 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:00.528920889 CEST	49707	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:00.528992891 CEST	443	49707	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:00.529076099 CEST	49707	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:00.536945105 CEST	49707	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:00.536981106 CEST	443	49707	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:00.584043026 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:00.615375996 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:00.615488052 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:00.633690119 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:00.635171890 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:00.754863024 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:00.758932114 CEST	443	49707	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:00.759000063 CEST	49707	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:00.763166904 CEST	49707	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:00.763190031 CEST	443	49707	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:00.763545990 CEST	443	49707	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:00.807055950 CEST	49707	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:00.837713003 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:00.855674982 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:00.855834961 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:00.963651896 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:00.974334955 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:00.974437952 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:00.987601042 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:01.078051090 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:01.193897009 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:01.210150003 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:01.238528967 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:01.254523993 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:01.275918961 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:01.495318890 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:01.588387966 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:01.620204926 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:01.895342112 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:03.336210012 CEST	49707	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:03.384208918 CEST	443	49707	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:03.470485926 CEST	443	49707	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:03.470602036 CEST	443	49707	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:03.470803022 CEST	49707	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:03.473037958 CEST	49707	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:03.473038912 CEST	49707	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:03.473100901 CEST	443	49707	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:03.473135948 CEST	443	49707	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:03.605602026 CEST	49709	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:03.605681896 CEST	443	49709	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:03.605786085 CEST	49709	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:03.606260061 CEST	49709	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:03.606302023 CEST	443	49709	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:03.830745935 CEST	443	49709	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:03.831027031 CEST	49709	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:03.834363937 CEST	49709	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:03.834414959 CEST	443	49709	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:03.834683895 CEST	443	49709	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:03.836033106 CEST	49709	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:03.876151085 CEST	443	49709	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:04.176630974 CEST	443	49709	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:04.176723957 CEST	443	49709	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:04.176795006 CEST	49709	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:04.178607941 CEST	49709	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:04.178608894 CEST	49709	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:04.178656101 CEST	443	49709	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:04.178685904 CEST	443	49709	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:04.179383993 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:04.213398933 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:04.426990032 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:04.442778111 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:04.494581938 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:04.510330915 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:04.743664026 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:04.791425943 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:04.838454008 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:05.073441029 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.073503017 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.073543072 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.073581934 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.073616982 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:05.073622942 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.073657990 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:05.073661089 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.073699951 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:05.073699951 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.073739052 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.073776007 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.073817015 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.073929071 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:05.073929071 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:05.293076992 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.293140888 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.293180943 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.293194056 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:05.293220043 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.293263912 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.293266058 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:05.385308981 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:05.385308981 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:05.419564009 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:05.617497921 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.646121025 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:05.713845968 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:05.791490078 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:05.947765112 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:06.088311911 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:06.186688900 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:06.186733007 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:06.186789989 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:06.188057899 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:06.188070059 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:06.253062963 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:06.253099918 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:06.253173113 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:06.402733088 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:06.402812958 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:06.403932095 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:06.403943062 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:06.404156923 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:06.494554043 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:07.490751982 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:07.490787029 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:07.711576939 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:07.711662054 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:08.866038084 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:08.866067886 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:08.867064953 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:08.988409996 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:09.382972002 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:09.424160004 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:09.516634941 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:09.516921043 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:09.516997099 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:09.517201900 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:09.517225981 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:09.517241001 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:09.517247915 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:09.534461975 CEST	49712	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:09.534549952 CEST	443	49712	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:09.534646988 CEST	49712	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:09.534938097 CEST	49712	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:09.534971952 CEST	443	49712	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:09.759715080 CEST	443	49712	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:09.759840965 CEST	49712	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:09.761585951 CEST	49712	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:09.761619091 CEST	443	49712	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:09.761957884 CEST	443	49712	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:09.763649940 CEST	49712	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:09.794217110 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:09.804121971 CEST	443	49712	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:09.840111971 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:09.928968906 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:09.929318905 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:09.929394960 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:09.929564953 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:09.929584980 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:09.929600000 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:09.929605007 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:09.993729115 CEST	49713	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:09.993813038 CEST	443	49713	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:09.993941069 CEST	49713	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:09.998043060 CEST	49713	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:09.998116016 CEST	443	49713	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:10.086098909 CEST	443	49712	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:10.086390018 CEST	443	49712	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:10.086467981 CEST	49712	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:10.222889900 CEST	443	49713	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:10.222995043 CEST	49713	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:10.249080896 CEST	49713	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:10.249150991 CEST	443	49713	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:10.250030994 CEST	443	49713	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:10.251669884 CEST	49713	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:10.292150021 CEST	443	49713	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:10.584223986 CEST	443	49713	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:10.584465027 CEST	443	49713	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:10.584556103 CEST	49713	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:10.585751057 CEST	49713	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:10.585796118 CEST	443	49713	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:10.585829020 CEST	49713	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:10.585844994 CEST	443	49713	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:10.586162090 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:10.838393927 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:10.921380997 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:11.148922920 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.244930029 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:11.425501108 CEST	49712	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:11.425575018 CEST	443	49712	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:11.425614119 CEST	49712	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:11.425632000 CEST	443	49712	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:11.426095009 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:11.480559111 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.480581045 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.480597973 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.480617046 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.480635881 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.480653048 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.480657101 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:11.480716944 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:11.480719090 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.480739117 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.480756044 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.480773926 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.480807066 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:11.480840921 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:11.689713955 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.702575922 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.702600002 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.702617884 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.702640057 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.702658892 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:11.702826023 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:11.770591021 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:11.801337004 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.008755922 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.039798021 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.088309050 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.103986025 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.104563951 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.135521889 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.146724939 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.341346025 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.341377974 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.341397047 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.341415882 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.341434002 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.341438055 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.341454029 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.341464043 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.341473103 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.341492891 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.341510057 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.341512918 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.341531038 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.341537952 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.341592073 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.365549088 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.365672112 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.367867947 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.372193098 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.560751915 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.560781956 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.560801029 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.560820103 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.560841084 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.560857058 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.560930967 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.584542990 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.603943110 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.644711971 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.651124954 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.774151087 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.884119987 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:12.979393959 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:12.992774010 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:13.103986979 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:13.104165077 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:13.211968899 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:13.275820971 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:13.363368034 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:17.213411093 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:17.443059921 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:17.510173082 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:19.148138046 CEST	49721	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:19.148189068 CEST	443	49721	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:19.148264885 CEST	49721	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:19.149502039 CEST	49721	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:19.149519920 CEST	443	49721	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:19.365986109 CEST	443	49721	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:19.366051912 CEST	49721	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:19.367865086 CEST	49721	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:19.367875099 CEST	443	49721	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:19.368218899 CEST	443	49721	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:19.421308994 CEST	49721	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:20.647766113 CEST	49721	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:20.688119888 CEST	443	49721	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:20.783639908 CEST	443	49721	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:20.783744097 CEST	443	49721	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:20.785027027 CEST	49721	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:20.785109043 CEST	49721	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:20.785135031 CEST	443	49721	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:20.785186052 CEST	49721	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:20.785197020 CEST	443	49721	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:20.800515890 CEST	49722	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:20.800594091 CEST	443	49722	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:20.800719023 CEST	49722	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:20.800973892 CEST	49722	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:20.801026106 CEST	443	49722	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:21.016460896 CEST	443	49722	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:21.016617060 CEST	49722	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:21.017887115 CEST	49722	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:21.017910004 CEST	443	49722	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:21.018173933 CEST	443	49722	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:21.019583941 CEST	49722	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:21.060121059 CEST	443	49722	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:21.217190027 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:21.337680101 CEST	443	49722	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:21.337892056 CEST	443	49722	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:21.337970972 CEST	49722	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:21.338100910 CEST	49722	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:21.338100910 CEST	49722	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:21.338145971 CEST	443	49722	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:21.338172913 CEST	443	49722	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:21.338614941 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:21.594286919 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:21.666857004 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:21.898823977 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:21.994556904 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:21.994748116 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:22.229648113 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.229696035 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.229783058 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.229783058 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:22.229821920 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.229876041 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.229912996 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.229923964 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:22.229952097 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.229989052 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.229995966 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:22.230026960 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:22.230026960 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.230084896 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.230379105 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:22.275835991 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:22.448771954 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.448792934 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.448817968 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.448834896 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.448839903 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:22.448854923 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.448889971 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:22.541624069 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:22.777888060 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:22.885441065 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:23.118058920 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:23.197688103 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:24.275974989 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:24.441729069 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:24.441831112 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:24.450165033 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:24.660718918 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:24.668859005 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:24.670758009 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:24.871459007 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:24.890079021 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:25.103986025 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:25.145138979 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:26.410870075 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:26.479141951 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:26.897089958 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:27.160408020 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:29.454648972 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:29.454722881 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:29.479123116 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:29.674038887 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:29.674190044 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:29.721199989 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:29.775831938 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:29.941664934 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:30.864188910 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:30.994561911 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:31.031156063 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:31.270510912 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:31.301067114 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:31.478940010 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:31.681260109 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:31.941643953 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:32.588352919 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:32.807459116 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:32.816581011 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:32.816647053 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:32.989820957 CEST	49724	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:32.989867926 CEST	443	49724	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:32.989933014 CEST	49724	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:32.990664959 CEST	49724	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:32.990681887 CEST	443	49724	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:33.209053040 CEST	443	49724	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:33.209197044 CEST	49724	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:33.213619947 CEST	49724	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:33.213637114 CEST	443	49724	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:33.213983059 CEST	443	49724	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:33.307056904 CEST	49724	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:34.350585938 CEST	49724	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:34.396148920 CEST	443	49724	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:34.494736910 CEST	443	49724	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:34.494848967 CEST	443	49724	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:34.494959116 CEST	49724	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:34.495398045 CEST	49724	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:34.495440006 CEST	443	49724	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:34.495466948 CEST	49724	443	192.168.2.5	34.117.186.192
Apr 22, 2024 01:53:34.495481968 CEST	443	49724	34.117.186.192	192.168.2.5
Apr 22, 2024 01:53:34.502047062 CEST	49725	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:34.502098083 CEST	443	49725	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:34.502156973 CEST	49725	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:34.502449989 CEST	49725	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:34.502475023 CEST	443	49725	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:34.727164030 CEST	443	49725	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:34.727246046 CEST	49725	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:35.389342070 CEST	49725	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:35.389390945 CEST	443	49725	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:35.389823914 CEST	443	49725	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:35.391282082 CEST	49725	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:35.432153940 CEST	443	49725	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:35.578933001 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:35.578989029 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:35.607774973 CEST	443	49725	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:35.607882023 CEST	443	49725	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:35.607949972 CEST	49725	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:35.608159065 CEST	49725	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:35.608159065 CEST	49725	443	192.168.2.5	172.67.75.166
Apr 22, 2024 01:53:35.608202934 CEST	443	49725	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:35.608227968 CEST	443	49725	172.67.75.166	192.168.2.5
Apr 22, 2024 01:53:35.608563900 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:35.801155090 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:35.801222086 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:35.861342907 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:35.861500978 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:35.879348993 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:35.887064934 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:35.934926987 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:36.077775002 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.080841064 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.080869913 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.080912113 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:36.167134047 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.260396004 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:36.348381996 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.495934010 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.495965004 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.495984077 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.496005058 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.496064901 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:36.715121031 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.715183973 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.715224028 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.715259075 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:36.715264082 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.715303898 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.715320110 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:36.715343952 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.715380907 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.715404034 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:36.715421915 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.715589046 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:36.934369087 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.934462070 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.934504032 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:36.934633017 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:37.025897980 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:37.259449959 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:37.276261091 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:37.353980064 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:37.505574942 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:37.586787939 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:37.591748953 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:37.775892019 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:38.322767019 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:38.552416086 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:38.666568995 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:38.775814056 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:38.894465923 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:38.897567987 CEST	58709	49706	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:38.897648096 CEST	49706	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:39.010246992 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:39.229749918 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:39.238637924 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:39.238729000 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:42.656821012 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:42.807081938 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:44.375036955 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:44.658862114 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:47.973422050 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:48.208590984 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:48.400810003 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:48.685653925 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:48.685713053 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:48.905706882 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:48.905769110 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:48.905808926 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:49.175988913 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:51.697757959 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:51.917109966 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:51.927100897 CEST	58709	49715	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:51.927191019 CEST	49715	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:54.436634064 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:54.436719894 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:54.655891895 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:54.655993938 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:54.785797119 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:54.875245094 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:54.875339985 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:55.145371914 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:53:57.449542999 CEST	49723	58709	192.168.2.5	147.45.47.93
Apr 22, 2024 01:53:57.668229103 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:54:07.285542011 CEST	58709	49723	147.45.47.93	192.168.2.5
Apr 22, 2024 01:54:07.285654068 CEST	49723	58709	192.168.2.5	147.45.47.93

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 22, 2024 01:53:00.383691072 CEST	62709	53	192.168.2.5	1.1.1.1
Apr 22, 2024 01:53:00.489476919 CEST	53	62709	1.1.1.1	192.168.2.5
Apr 22, 2024 01:53:03.496237040 CEST	59311	53	192.168.2.5	1.1.1.1
Apr 22, 2024 01:53:03.603782892 CEST	53	59311	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 22, 2024 01:53:00.383691072 CEST	192.168.2.5	1.1.1.1	0x1258	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Apr 22, 2024 01:53:03.496237040 CEST	192.168.2.5	1.1.1.1	0xf88f	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 22, 2024 01:53:00.489476919 CEST	1.1.1.1	192.168.2.5	0x1258	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Apr 22, 2024 01:53:03.603782892 CEST	1.1.1.1	192.168.2.5	0xf88f	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
Apr 22, 2024 01:53:03.603782892 CEST	1.1.1.1	192.168.2.5	0xf88f	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
Apr 22, 2024 01:53:03.603782892 CEST	1.1.1.1	192.168.2.5	0xf88f	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	34.117.186.192	443	5504	C:\Users\user\Desktop\ygm2mXUReY.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 23:53:03 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-21 23:53:03 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sun, 21 Apr 2024 23:53:03 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-21 23:53:03 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-21 23:53:03 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	172.67.75.166	443	5504	C:\Users\user\Desktop\ygm2mXUReY.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 23:53:03 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-21 23:53:04 UTC	660	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 23:53:04 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471F6F:434C_93878F2E:0050_6625A6E0_938E887:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XX5aLPBiVQy%2BtINBy97%2BZe4BqF7gqb4rrVZNV1GrP%2FvzHWHHyAcmLRSNUpbT6l%2Bme8vpdERX%2FyDvySEQ0Bi5rgjzn5HOx4vBbZl9RG8n2n9DX9FTMH%2ByH67EzQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87814a98298aade7-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 23:53:04 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-21 23:53:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	34.117.186.192	443	1672	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 23:53:09 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-21 23:53:09 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sun, 21 Apr 2024 23:53:09 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-21 23:53:09 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-21 23:53:09 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49712	172.67.75.166	443	1672	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 23:53:09 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-21 23:53:10 UTC	656	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 23:53:10 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC454759:4A04_93878F2E:0050_6625A6E6_938E90B:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sGr6Mj6CB147ELrFjCYnPJYfTjr3Zly%2BAoGLC3%2FeCAnYX%2BaOqAd%2FPLPaGTJBOgCC7WDowH6d8vEosLTuZrY2K7WMPybyFspqXblPtWBbYgGwaruexuDokgbwBw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87814abd397f44f1-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 23:53:10 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-21 23:53:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49711	34.117.186.192	443	736	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 23:53:09 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-21 23:53:09 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sun, 21 Apr 2024 23:53:09 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-21 23:53:09 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-21 23:53:09 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49713	172.67.75.166	443	736	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 23:53:10 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-21 23:53:10 UTC	652	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 23:53:10 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: 6CA2EE8B:A8BE_93878F2E:0050_6625A6E6_93647FF:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=361ZuXxSEt5CUilZpEPQP8b4wCMFOyvTvUFNLPko%2F8cpiQDgNs%2BKpiNZ3BtosOYA825yYT1TO9w6RXSewcrRP6GuWjGx9QSb52pBe8YHx5W2bbQi34Vmus2QkQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87814ac01ee9138f-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 23:53:10 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-21 23:53:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49721	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-04-21 23:53:20 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-21 23:53:20 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sun, 21 Apr 2024 23:53:20 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 4 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-21 23:53:20 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-21 23:53:20 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49722	172.67.75.166	443

Timestamp	Bytes transferred	Direction	Data
2024-04-21 23:53:21 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-21 23:53:21 UTC	656	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 23:53:21 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: 6CA2EDAD:3916_93878F2E:0050_6625A6F1_938E9F6:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P9bA4ZQ45DqHMyngyLugE4xs5jInA%2BbM7MDaT%2BUkGfboufSNCV2ISF5PAzzztm9ZOko0Ux1koMTDMUuuFV3XYLMOygwdYKe6Bxacom3wBpUz5G%2BFECBhh%2FekFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87814b039d8b8bb6-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 23:53:21 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-21 23:53:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49724	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-04-21 23:53:34 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-21 23:53:34 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sun, 21 Apr 2024 23:53:34 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-21 23:53:34 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-21 23:53:34 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49725	172.67.75.166	443

Timestamp	Bytes transferred	Direction	Data
2024-04-21 23:53:35 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-21 23:53:35 UTC	656	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 23:53:35 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: 6CA2EE3E:9878_93878F2E:0050_6625A6FF_93649FF:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XoX9TS4TNyJm9YmwaNg6ru2Tyzj4qvvSZ1RoIaTqlv6Ci%2B0sMRIYtaorHKBxm39EWRxGyn%2Fyb4Ls3yPbvGOqURM5tIk%2BBh028NOLcOuebUWp8Zp%2BWjxDC7FxQg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87814b5c8f5c1399-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 23:53:35 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-21 23:53:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	01:52:50
Start date:	22/04/2024
Path:	C:\Users\user\Desktop\ygm2mXUReY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ygm2mXUReY.exe"
Imagebase:	0x400000
File size:	997'888 bytes
MD5 hash:	D668244429E4A7A0B205B2CE843B9663
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2415576693.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2413162518.000000000427D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2413282182.000000000435E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2414862397.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:52:52
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x640000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:52:52
Start date:	22/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:52:53
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x640000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:52:53
Start date:	22/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:52:53
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 796
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:52:53
Start date:	22/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	997'888 bytes
MD5 hash:	D668244429E4A7A0B205B2CE843B9663
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000002.2590148325.000000000430C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2440628791.0000000004371000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000003.2442547295.000000000430B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000003.2442056915.000000000430B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000003.2441793106.000000000430B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.2590308249.0000000004656000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000009.00000002.2590418032.0000000005FE0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs Detection: 39%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:52:54
Start date:	22/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	997'888 bytes
MD5 hash:	D668244429E4A7A0B205B2CE843B9663
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000A.00000002.2607924286.0000000005F30000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000003.2439521788.0000000008E04000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.2607833266.00000000046C3000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.2607017449.0000000004477000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000A.00000002.2608848110.0000000008E08000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:52:55
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 952
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:52:56
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 984
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:52:57
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 992
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:52:57
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 1056
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	01:52:58
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 800
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:52:58
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 772
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	01:52:59
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 1380
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	01:53:00
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 896
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	01:53:00
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 1388
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	01:53:00
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 912
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	01:53:01
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 900
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	01:53:02
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 916
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	01:53:03
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 912
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	01:53:03
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 948
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	01:53:04
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1100
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	35.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	42%
Total number of Nodes:	2000
Total number of Limit Nodes:	160

Executed Functions

Function 0045578C Relevance: 82.6, APIs: 39, Strings: 6, Instructions: 3900
sleeplibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000), ref: 0045586E
GetLastError.KERNEL32 ref: 00455880
Sleep.KERNEL32(00000529), ref: 004558A5
Sleep.KERNEL32(0000002F), ref: 00455985
shutdown.WS2_32(00000002), ref: 004559A3
closesocket.WS2_32 ref: 004559AF
WSACleanup.WS2_32 ref: 004559B5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00455A77
Sleep.KERNELBASE(00000065), ref: 00455CD9
Sleep.KERNEL32(00000000), ref: 00455D96
GetProcAddress.KERNEL32(00000000,?), ref: 004567CD
GetCurrentProcess.KERNEL32(00000000), ref: 004567DB
OutputDebugStringA.KERNELBASE(Dk43l_dwmk438*,?,00000018,0000000A,Function_000031C0,?,?,?,?,?,?,?,?,?,?), ref: 004567EF
OutputDebugStringA.KERNELBASE(ewetwertyer eytdryrtdy,?,?), ref: 004569BE
OutputDebugStringA.KERNEL32(td ydrthrhfty,?,?,?,?,?,?,?), ref: 00456F72

Strings

43t res tgy45yfhyrt, xrefs: 0045A290
er ert 346 34634 6ch, xrefs: 00458D6B
ewetwertyer eytdryrtdy, xrefs: 004569B4
td ydrthrhfty, xrefs: 00456F68
ntdll.dll, xrefs: 004567B6
Dk43l_dwmk438*, xrefs: 004567EA

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Sleep$DebugOutputString$AddressCleanupCreateCurrentErrorLastMutexProcProcessUnothrow_t@std@@@__ehfuncinfo$??2@closesocketshutdown
String ID: 43t res tgy45yfhyrt$Dk43l_dwmk438*$er ert 346 34634 6ch$ewetwertyer eytdryrtdy$ntdll.dll$td ydrthrhfty
API String ID: 3261302857-3574556348
Opcode ID: e2264d598bb945190a8d28aa9f3342592530cff6afa120e4bdadfad501149194
Instruction ID: b7004e79db67d020d65fac00f85910b7803af71aabf98f32d17772c606b18a4d
Opcode Fuzzy Hash: e2264d598bb945190a8d28aa9f3342592530cff6afa120e4bdadfad501149194
Instruction Fuzzy Hash: 74A302B45083818FC335CF19C491AABBBE1BFD8344F54495EE8899B352DB34A949CF86

Uniqueness

Uniqueness Score: -1.00%

Function 00453C30 Relevance: 68.1, APIs: 33, Strings: 5, Instructions: 1568
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000025), ref: 00453C44

Part of subcall function 004E2FA0: __Xtime_get_ticks.LIBCPMT ref: 004E2FA1
Part of subcall function 004E2FA0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004E2FAF

GetCurrentProcess.KERNEL32(00008000,00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00000001), ref: 00453DCD
SetPriorityClass.KERNELBASE(00000000), ref: 00453DD4
SetUnhandledExceptionFilter.KERNEL32(0045A780), ref: 00453DDF

Strings

43t res tgy45yfhyrt, xrefs: 0045A290
er ert 346 34634 6ch, xrefs: 00458D6B
147.45.47.93:58709, xrefs: 00453CE7
131, xrefs: 00453CA1, 00453CC4
Dk43l_dwmk438*, xrefs: 004567EA

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ClassCurrentExceptionFilterPriorityProcessSleepUnhandledUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: 131$147.45.47.93:58709$43t res tgy45yfhyrt$Dk43l_dwmk438*$er ert 346 34634 6ch
API String ID: 1211644118-3950233817
Opcode ID: 8d8c02fe4a4adf820417fc490fd3e6e4d0eacc456a3f3a4f9d37f490fef82baa
Instruction ID: 58df280d1c5bcf31294a4ea42ed0208b52652377ae8c263acff41185647b5a58
Opcode Fuzzy Hash: 8d8c02fe4a4adf820417fc490fd3e6e4d0eacc456a3f3a4f9d37f490fef82baa
Instruction Fuzzy Hash: F70326B45083829FC324DF29C491AABBBE4FFD8345F40491EE98997352DB30A549CF96

Uniqueness

Uniqueness Score: -1.00%

Function 004091BF Relevance: 49.3, APIs: 25, Strings: 1, Instructions: 3810COMMON

Download Yara Rule

APIs

Part of subcall function 004F2F40: GetModuleHandleA.KERNEL32(?), ref: 004F3048
Part of subcall function 004F2F40: GetProcAddress.KERNEL32(00000000,?), ref: 004F3053

CreateDirectoryA.KERNELBASE(00000000,00000000,?), ref: 0040A601

Strings

U5I, xrefs: 0040C4E4

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: AddressCreateDirectoryHandleModuleProc
String ID: U5I
API String ID: 2385557062-2587217555
Opcode ID: 8c11a0b71fb49e27c04e9c61b3a7d0b6115fdaaf64288d36ff250782081a8979
Instruction ID: 4cdd386919e838af970f59fa8ac5a494f476b57722eda99af27e3df303c9e173
Opcode Fuzzy Hash: 8c11a0b71fb49e27c04e9c61b3a7d0b6115fdaaf64288d36ff250782081a8979
Instruction Fuzzy Hash: EAA3DFB4D052689BDB25CFA9D991ADDFBB0BF48304F1081DAE849B7341DB306A84CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0049D110 Relevance: 41.6, APIs: 18, Strings: 4, Instructions: 3107registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,?,?,?,?,?,?,?,?,?), ref: 0049D33D
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0049D374
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0049D39A
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000001,?,?), ref: 0049D53A
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000001,?,00000104), ref: 0049D7A8
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000001,?,?), ref: 0049D895
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000003,?,?), ref: 0049D9D6
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000003,?,?), ref: 0049DAC3
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000003,?,?), ref: 0049DBB0
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000003,?,?), ref: 0049DC9D

Part of subcall function 0042FC4B: RaiseException.KERNEL32(E06D7363,00000001,00000003,00417EFB,?,?,?,0042C598,00417EFB,005784EC,?,00417EFB), ref: 0042FCAB

RegCloseKey.ADVAPI32(00000000), ref: 0049EE67
RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 0049EEA0
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049EEB4

Strings

cannot use operator[] with a string argument with , xrefs: 0049EF75
invalid stoi argument, xrefs: 004A002F
stoi argument out of range, xrefs: 004A0025
cannot use push_back() with , xrefs: 0049EF16

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: QueryValue$CloseEnumOpen$ExceptionRaise
String ID: cannot use operator[] with a string argument with $cannot use push_back() with $invalid stoi argument$stoi argument out of range
API String ID: 2021570681-1606007317
Opcode ID: 71b2d8943ec01a9fff98d9eed412fd704d662f4c64c517adeec3da0b722de419
Instruction ID: 57cc1c8c03c56a0844d741e814d2024dbcff269c685614372db8ad591986b9b7
Opcode Fuzzy Hash: 71b2d8943ec01a9fff98d9eed412fd704d662f4c64c517adeec3da0b722de419
Instruction Fuzzy Hash: 726336B4D002689FDB25CF68C885BEEBBB5BF49304F1481EAE449A7341DB346A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0045504E Relevance: 30.3, APIs: 16, Strings: 1, Instructions: 544
sleepsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_000D23C0,00000000,00000000,00000000), ref: 0045518C
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00455193
Sleep.KERNELBASE(00000001), ref: 00455259
GetTempPathA.KERNEL32(000000FC,?,?), ref: 00455358

Part of subcall function 004F2CD0: GetFileAttributesA.KERNELBASE(?,?,?,0055A5B3,000000FF), ref: 004F2D0C
Part of subcall function 004F2CD0: GetLastError.KERNEL32(?,?,0055A5B3,000000FF), ref: 004F2D17

Part of subcall function 004F2870: FindFirstFileA.KERNELBASE(?,?,00588E90,?,?,?,\*.*,00000004), ref: 004F298C

Part of subcall function 004F2870: FindNextFileA.KERNELBASE(00000000,00000010), ref: 004F2B28
Part of subcall function 004F2870: FindClose.KERNEL32(00000000), ref: 004F2B38
Part of subcall function 004F2870: GetLastError.KERNEL32 ref: 004F2B3E

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00455601
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00455628

Part of subcall function 00407B10: GetFileAttributesA.KERNELBASE(?,7FFFFFFF,?,?,?,?,00000000,00558869,000000FF,?,?,00000000,00000001), ref: 00407B6A
Part of subcall function 00407B10: CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000,00558869,000000FF,?,?,00000000), ref: 00407BF2

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045563F
OutputDebugStringA.KERNELBASE(43t res tgy45yfhyrt), ref: 0045A295
CreateMutexA.KERNEL32(00000000,00000001,00000000), ref: 0045A407
GetLastError.KERNEL32 ref: 0045A419
Sleep.KERNEL32(00007530), ref: 0045A435

Strings

43t res tgy45yfhyrt, xrefs: 0045A290

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Create$FileFind$DirectoryErrorLast$AttributesCloseSleep$ChangeDebugFirstMutexNextNotificationOutputPathStringTempThreadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: 43t res tgy45yfhyrt
API String ID: 2654281156-696058833
Opcode ID: 65718216c6e2e3310af10188051baf5db18f177b0a531d1ba93266077d052d0c
Instruction ID: 9c8f78141530d7c3e3186ab54bd11a1a12a778bbd7b21b6fbf1c18c7b6f6a787
Opcode Fuzzy Hash: 65718216c6e2e3310af10188051baf5db18f177b0a531d1ba93266077d052d0c
Instruction Fuzzy Hash: 52425AB45093819FC324DF29C491AAEBBE1FFD8344F40491EE98997352DB34A949CF86

Uniqueness

Uniqueness Score: -1.00%

Function 004CC610 Relevance: 23.1, APIs: 1, Strings: 11, Instructions: 2064COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,8C8DEFFF), ref: 004CC77E

Part of subcall function 004D0620: FindFirstFileA.KERNELBASE(?,?,?,?,?,00000000,?,?), ref: 004D0771

Strings

cannot use operator[] with a string argument with , xrefs: 004D05DB
fGVm, xrefs: 004CEF51
k>2, xrefs: 004CEC33
I, xrefs: 004CD2EF
fGVm, xrefs: 004CEC8B
cannot use push_back() with , xrefs: 004D057C
I, xrefs: 004CE325
$r(, xrefs: 004CEAFF
MjL, xrefs: 004CEA4F
I, xrefs: 004CE4DA
xH>, xrefs: 004CEAA7

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: $r($MjL$cannot use operator[] with a string argument with $cannot use push_back() with $fGVm$fGVm$k>2$xH>$I$I$I
API String ID: 2195519125-3021718430
Opcode ID: 32a86bd4c24c49e8a54171f69fdc18cd166235fe0773a6323aa8dbcea6e36457
Instruction ID: 58fff7fa39e1a7d59a690a9eb2d20e9a3d742f11dd313cf94c949deb9fb380dd
Opcode Fuzzy Hash: 32a86bd4c24c49e8a54171f69fdc18cd166235fe0773a6323aa8dbcea6e36457
Instruction Fuzzy Hash: 5143DAB4D052688BDB65CF68C991BDDBBB5BF48304F1081DAE809BB281DB346E84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004F2870 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 314
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,?,00588E90,?,?,?,\*.*,00000004), ref: 004F298C
SetFileAttributesA.KERNEL32(?,00000080,?,?,00588E90,?,?), ref: 004F2AFC
DeleteFileA.KERNEL32(?), ref: 004F2B16
FindNextFileA.KERNELBASE(00000000,00000010), ref: 004F2B28
FindClose.KERNEL32(00000000), ref: 004F2B38
GetLastError.KERNEL32 ref: 004F2B3E
SetFileAttributesA.KERNELBASE(?,00000080), ref: 004F2B5B
RemoveDirectoryA.KERNELBASE(?), ref: 004F2B79
GetLastError.KERNEL32 ref: 004F2B8E
std::_Throw_Cpp_error.LIBCPMT ref: 004F2C46
std::_Throw_Cpp_error.LIBCPMT ref: 004F2C57

Strings

\*.*, xrefs: 004F291D

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: File$Find$AttributesCpp_errorErrorLastThrow_std::_$CloseDeleteDirectoryFirstNextRemove
String ID: \*.*
API String ID: 460640838-1173974218
Opcode ID: 466bd1c2456f9acd82312103d6d78d4e925ff4445bf50abb06e90954b34695a9
Instruction ID: 430257b0234f4d6f71ca32d924a6ee1be9a9adcf3772e337a705ae905a87183e
Opcode Fuzzy Hash: 466bd1c2456f9acd82312103d6d78d4e925ff4445bf50abb06e90954b34695a9
Instruction Fuzzy Hash: 33B14730D002089FDB24DF68CD887FEBBB5EF15314F14421AE944A7392DBB8AA85DB55

Uniqueness

Uniqueness Score: -1.00%

Function 004DB860 Relevance: 21.1, APIs: 8, Strings: 3, Instructions: 1877fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000200,00000000,?,811C9DC5), ref: 004DBB97
GetUserNameA.ADVAPI32(?,00000104), ref: 004DBC19
CopyFileA.KERNEL32(?,?,00000000), ref: 004DC0BA

Strings

;pO, xrefs: 004DC987
vE[, xrefs: 004DC168
vE[, xrefs: 004DE24F

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: FileName$CopyModuleUser
String ID: ;pO$vE[$vE[
API String ID: 1118875727-272748310
Opcode ID: 76ffa0bdfd6289b060e5c8fa38f4cfab54ae458c93071afb60aa7699cd088874
Instruction ID: db02d0ea7d064c082f71bd976c7465a8fd94f5b3a7ef15bcedaf019b5b27ecd6
Opcode Fuzzy Hash: 76ffa0bdfd6289b060e5c8fa38f4cfab54ae458c93071afb60aa7699cd088874
Instruction Fuzzy Hash: 8023EFB4D002589BDB29CF98C990BEDBBB1AF49314F2451DAE849B7341DB315E84CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0045B010 Relevance: 20.2, APIs: 12, Instructions: 2241COMMON

Download Yara Rule

APIs

Part of subcall function 004091BF: CreateDirectoryA.KERNELBASE(00000000,00000000,?), ref: 0040A601

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045B14B
CreateDirectoryA.KERNEL32(0000000F,00000000,?,?), ref: 0045B6CD
CreateDirectoryA.KERNEL32(0000000F,00000000,0000000F,00000000,?,?), ref: 0045B8E9
CreateDirectoryA.KERNEL32(?,00000000,?,0000000F,00000000,?,?), ref: 0045BA77
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045C326
GetFileAttributesA.KERNEL32(00000000,?,?,?,?,?), ref: 0045C8B2
GetLastError.KERNEL32(?,?,?,?,?), ref: 0045C8BD

Part of subcall function 0042D43A: ReleaseSRWLockExclusive.KERNEL32(004F2D39), ref: 0042D44E

CreateDirectoryA.KERNEL32(?,00000000,?,?), ref: 0045C90D
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,6F2977B7,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 0045CB49
CreateDirectoryA.KERNEL32(00000000,00000000,6F2977B7,?,?,6F2977B7,?,00000000,00000000,?,?,?,?,?,?,6F2977B7), ref: 0045D1EF
std::_Throw_Cpp_error.LIBCPMT ref: 0045DB22
std::_Throw_Cpp_error.LIBCPMT ref: 0045DB33

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorExclusiveFileLastLockRelease
String ID:
API String ID: 4067333799-0
Opcode ID: 3398877c9ae5629ba07be7d59eef0d760106e9c111d3d6159deb06be24d4748c
Instruction ID: 68c8495f6346b6796ce830d8594ba972bb16e4ec352a3aae9e85973fddee60a8
Opcode Fuzzy Hash: 3398877c9ae5629ba07be7d59eef0d760106e9c111d3d6159deb06be24d4748c
Instruction Fuzzy Hash: E1334770D042689BDB25CF68CD847EDBBB5BF49304F1082DAE849A7242DB346E89CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004D3150 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 004D317A
getaddrinfo.WS2_32(?,?,?,00588CC0), ref: 004D31FC
socket.WS2_32(?,?,?), ref: 004D321D
connect.WS2_32(00000000,0055F6D1,?), ref: 004D3231
closesocket.WS2_32(00000000), ref: 004D323D
freeaddrinfo.WS2_32(?,?,?,?,00588CC0,?,?), ref: 004D324A
WSACleanup.WS2_32 ref: 004D3250
freeaddrinfo.WS2_32(?,?,?,?,00588CC0,?,?), ref: 004D3265

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: freeaddrinfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 58224237-0
Opcode ID: 9e6883013388f64e9fa16a16f0073357cf9f7d6acb3b040fdaf446918f01256a
Instruction ID: 66b7f2af6e1e00109afe9fd9f1c3058fd8df4c895de65cf13c46908161227474
Opcode Fuzzy Hash: 9e6883013388f64e9fa16a16f0073357cf9f7d6acb3b040fdaf446918f01256a
Instruction Fuzzy Hash: 7731E631A047009BD7209F29DC4862BB7E5FF85735F104B5FF9A4933E0D37899489696

Uniqueness

Uniqueness Score: -1.00%

Function 00409010 Relevance: 11.5, APIs: 5, Strings: 1, Instructions: 1046COMMON

Download Yara Rule

APIs

Part of subcall function 004F2F40: GetModuleHandleA.KERNEL32(?), ref: 004F3048
Part of subcall function 004F2F40: GetProcAddress.KERNEL32(00000000,?), ref: 004F3053

CreateDirectoryA.KERNELBASE(00000000,00000000,?), ref: 0040A601

Strings

cannot use operator[] with a string argument with , xrefs: 0040A47B

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: AddressCreateDirectoryHandleModuleProc
String ID: cannot use operator[] with a string argument with
API String ID: 2385557062-2766135566
Opcode ID: 64d0cee5f530ed2e08766c5bcfab9cc539caee87aec487504877893d86c93f37
Instruction ID: ded7b3acff67d6fc93a9f934a04086679630f068c6daeca2e519d3ea19527e87
Opcode Fuzzy Hash: 64d0cee5f530ed2e08766c5bcfab9cc539caee87aec487504877893d86c93f37
Instruction Fuzzy Hash: 74C210B4D042689BDB25CF58C984BDDBBB0BF58304F1481DAE849B7381DB746A84CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004F6660 Relevance: 11.4, APIs: 2, Strings: 4, Instructions: 909COMMON

Download Yara Rule

APIs

Part of subcall function 00424C30: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00424CC9
Part of subcall function 00424C30: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00424D11

GetFileAttributesA.KERNELBASE(?), ref: 004F6A45
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004F7081

Strings

status, xrefs: 004F7251
.zip, xrefs: 004F677F
@G@, xrefs: 004F7077
recursive_directory_iterator::recursive_directory_iterator, xrefs: 004F7267

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ___std_fs_convert_narrow_to_wide@20$AttributesFileIos_base_dtorstd::ios_base::_
String ID: .zip$@G@$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3330089674-1374571796
Opcode ID: dbecc60ade6f9cc5c517a97f52a0f8180f0e579495cfc7ae31c079beb9c3e3e9
Instruction ID: 5c112c02936b25d4fb78ed62e4cf61e9fc9cdc42541c04c932bd90300030b25b
Opcode Fuzzy Hash: dbecc60ade6f9cc5c517a97f52a0f8180f0e579495cfc7ae31c079beb9c3e3e9
Instruction Fuzzy Hash: 8482CE70D002588FDB14DF68C884BEEBBB1BF55304F1441AEE549A7292DB38AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 005209F0 Relevance: 11.3, Strings: 8, Instructions: 1305COMMON

Download Yara Rule

Strings

hU, xrefs: 00520BD1, 00520DE9, 00520E11, 00521172, 005214EE, 00521800, 00521981, 005219F1
out of memory, xrefs: 00521990, 00521A00
WITHOUT ROWID, xrefs: 00520A83, 00520AA7
WITHOUT ROWID, xrefs: 00520A2C, 00520A51, 00520A54
library routine called out of sequence, xrefs: 0052191B, 0052196F
unknown error, xrefs: 005219C4, 00521A34
d, xrefs: 00520D79
pkU, xrefs: 0052117C, 005214F8, 0052180A

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID:
String ID: WITHOUT ROWID$WITHOUT ROWID$d$library routine called out of sequence$out of memory$pkU$unknown error$hU
API String ID: 0-3288033085
Opcode ID: d6ade1b6623ac6609edd131df4967f6f5a91463fcd52ce4648a594e49f9ad005
Instruction ID: 497802968e842dde83b933efc766fcc9b30b40c45d497888dbf4db774b5c934f
Opcode Fuzzy Hash: d6ade1b6623ac6609edd131df4967f6f5a91463fcd52ce4648a594e49f9ad005
Instruction Fuzzy Hash: 5CB2CF70605B52DFC728CF28E494A6BBBF1BF96304F14492DE88A97391D731E845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0045A5C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 0045A5D3
GetCursorPos.USER32(?), ref: 0045A5D9
Sleep.KERNELBASE(000003E9,?,?,?,?,?,?,?,?,?,?,?,00453DEA), ref: 0045A688
GetCursorPos.USER32(?), ref: 0045A68E
Sleep.KERNELBASE(00000001,?,?,?,?,?,?,?,?,?,?,?,00453DEA), ref: 0045A73A

Strings

=E, xrefs: 0045A720, 0045A668

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Cursor$Sleep
String ID: =E
API String ID: 1847515627-2289002813
Opcode ID: 87aaf06eb3feef4bfb938811ad3031e6b1e2923ec5a892cc3e26860d6edd803d
Instruction ID: 823f227e19ebc1f4262c84ee3b7a9e46c16cc5b48225767440be61142120e435
Opcode Fuzzy Hash: 87aaf06eb3feef4bfb938811ad3031e6b1e2923ec5a892cc3e26860d6edd803d
Instruction Fuzzy Hash: B151CC35A00215CFCB18CF58C4C4EAAB7B1FF49705F19429AD945AB312D739ED1ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 004B36B0 Relevance: 10.4, APIs: 1, Strings: 4, Instructions: 1610COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 004B384B

Part of subcall function 0041A800: ___std_exception_destroy.LIBVCRUNTIME ref: 0041A959

Strings

I, xrefs: 004B4A04
cannot use operator[] with a string argument with , xrefs: 004B5E3C
I, xrefs: 004B40FA
I, xrefs: 004B4BB9

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: FolderPath___std_exception_destroy
String ID: cannot use operator[] with a string argument with $I$I$I
API String ID: 3548636424-122575368
Opcode ID: dba2a0ee44e8d4b3865d9519a6f8c301ab1a7b499268f81b258f7d926f9999a8
Instruction ID: df9c875d8cc877c3b3a93ee254c84c4b376f22100dfb1a1e0afc37ba53127f04
Opcode Fuzzy Hash: dba2a0ee44e8d4b3865d9519a6f8c301ab1a7b499268f81b258f7d926f9999a8
Instruction Fuzzy Hash: 2803F0B4D002689BDB29CF68D980BDDBBB5AF49304F1481DAE449BB341DB346E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004DF790 Relevance: 9.5, APIs: 6, Instructions: 540
processlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000200,?,?,811C9DC5), ref: 004DF7D2
GetModuleHandleA.KERNEL32(?), ref: 004DFBF1
GetProcAddress.KERNEL32(00000000,?), ref: 004DFBFC
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004DFC4C

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Module$AddressCreateFileHandleNameProcProcess
String ID:
API String ID: 347136680-0
Opcode ID: 1114ed769da3d7834aeeed2b80c93af95e2cbb04c664a99da593df4f1207dd32
Instruction ID: 1c398614b8e40d06d673246c6905bd3bbdd575ff32f9acac0e67e79eca0af1e2
Opcode Fuzzy Hash: 1114ed769da3d7834aeeed2b80c93af95e2cbb04c664a99da593df4f1207dd32
Instruction Fuzzy Hash: 393258B4D00249AFDB10CF98D995BEEFBB1FF48314F20425AE849AB381D7346A45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040D468 Relevance: 9.4, APIs: 4, Strings: 1, Instructions: 697
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 0040DE68

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: 0
API String ID: 1799206407-4108050209
Opcode ID: 20c5174ce98549ec0c6dd1ca7c0aa0ae184400a2f8ba70ec022d77deb839179e
Instruction ID: d3553316db2c8dc36a3c53aaf8957dde30e24de572f0d1dfc5b1ab8cdc92ac15
Opcode Fuzzy Hash: 20c5174ce98549ec0c6dd1ca7c0aa0ae184400a2f8ba70ec022d77deb839179e
Instruction Fuzzy Hash: 9F82D1B4D1526C9BDB25DFA9D881ADCFBB4BF58304F0081AAE819B7341DB346A84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA55 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 509
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040CC14
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040CD14
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040D1DD
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040D332

Strings

!, xrefs: 0040CC49

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: CopyCreateDirectoryFile
String ID: !
API String ID: 3761107634-2657877971
Opcode ID: 6e410194fcd50901128c0766d10c1e75220fdc67d70d05ee7b3424c3a4a01f65
Instruction ID: e66ea828580897357c3337ece30a7bcdfe6fa77db8e0ad74278681913a0db402
Opcode Fuzzy Hash: 6e410194fcd50901128c0766d10c1e75220fdc67d70d05ee7b3424c3a4a01f65
Instruction Fuzzy Hash: DF52E2B8D052689BDB24DF69D981ADCBBB0BF48314F1481EAE849B7341DB305E84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040E58B Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

Part of subcall function 004F2CD0: GetFileAttributesA.KERNELBASE(?,?,?,0055A5B3,000000FF), ref: 004F2D0C
Part of subcall function 004F2CD0: GetLastError.KERNEL32(?,?,0055A5B3,000000FF), ref: 004F2D17

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040E794
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040EA49

Strings

B, xrefs: 0040E6C9

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID: B
API String ID: 2267087916-1255198513
Opcode ID: 4675d498882eaab8bcb66d508d4128d8251963df79c65c724d9ca310621736ae
Instruction ID: 18f978b0f6646b41db9d4fa06ff2f241acb7d76137c4f260d1526695a4699fe5
Opcode Fuzzy Hash: 4675d498882eaab8bcb66d508d4128d8251963df79c65c724d9ca310621736ae
Instruction Fuzzy Hash: 385204B4D1526C9BDB25CFA9E981ADCFBB4BF48304F0081AAE919B7341D7341A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0045A790 Relevance: 7.0, APIs: 4, Instructions: 978COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bbc3f51b43f695e9222ab255970085400a039c6b60fc997b3937aa89b263090
Instruction ID: 9c4df05857bd84bc3601df45bbcef84d76791ef7a0d211089cd22e916cc2e826
Opcode Fuzzy Hash: 9bbc3f51b43f695e9222ab255970085400a039c6b60fc997b3937aa89b263090
Instruction Fuzzy Hash: 63A23470C042689BDB25CF68CD84BEDBBB5AF59304F1082DAE849B7252DB345E89CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004D0620 Relevance: 6.8, APIs: 4, Instructions: 813fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,?,?,?,?,00000000,?,?), ref: 004D0771
FindNextFileA.KERNELBASE(0000000F,00000010), ref: 004D0A36
GetLastError.KERNEL32 ref: 004D0A44
FindClose.KERNEL32(0000000F), ref: 004D0A56

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: 80ee2970e38f4273906cd25c5a92e64dfdc436b510b4c9ae48cb12752955babb
Instruction ID: e03e187f96ff4dfc0117b7cb6e2bb59febb9782db7a0b13eee296deb0d69a62d
Opcode Fuzzy Hash: 80ee2970e38f4273906cd25c5a92e64dfdc436b510b4c9ae48cb12752955babb
Instruction Fuzzy Hash: C7827BB0D002499FDB14CFA4C9917EEBBB1FF58304F14829AD8496B342D734AA85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004479BE Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00447E03,00000000,00000000,00000000), ref: 00447CC2

Strings

W. Europe Summer Time, xrefs: 00447D6F
W. Europe Standard Time, xrefs: 00447D5B

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: InformationTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 565725191-690618308
Opcode ID: 45ed093c542864df7f6f6bfdd000931ff422ff8c2949e65a0c88095de6a35219
Instruction ID: ea3c3819e00c7610c2bdce84c30dacc5ed2750e9284a6662424918e6eb4f3f86
Opcode Fuzzy Hash: 45ed093c542864df7f6f6bfdd000931ff422ff8c2949e65a0c88095de6a35219
Instruction Fuzzy Hash: A2C13771D04115ABEB10BF65DC02ABF7BA9EF04758F64445BF900EB281EB389E42C798

Uniqueness

Uniqueness Score: -1.00%

Function 004D1240 Relevance: 4.6, APIs: 3, Instructions: 116encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004D1275
LocalFree.KERNEL32(?), ref: 004D12A4
LocalFree.KERNEL32(?,?), ref: 004D1365

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: 480f089e8aa9593477093ee309531afa414506aca0b47826191162f980436ade
Instruction ID: edacca0892e7d6bf58cfe28d189f09218ecc2b188b76278acbc21aeb1f3e2cb0
Opcode Fuzzy Hash: 480f089e8aa9593477093ee309531afa414506aca0b47826191162f980436ade
Instruction Fuzzy Hash: DD312631D001086BEB00ABA9DC857FEB779EF59314F00817BEC18B7351EB3959858BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042C82B Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,004209DA,?), ref: 0042C837
FindFirstFileExW.KERNELBASE(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,004209DA,?), ref: 0042C866
GetLastError.KERNEL32(?,004209DA,?), ref: 0042C878

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 86c14a02093f16810e4dd88f91deff2d5f86e2f0abe4bed8fc1f86c1b24be754
Instruction ID: 8a27f9886f01e289c274a129579c59828a859e60d8a88321f661c1881ad45666
Opcode Fuzzy Hash: 86c14a02093f16810e4dd88f91deff2d5f86e2f0abe4bed8fc1f86c1b24be754
Instruction Fuzzy Hash: B4F0B431100518BFDB103F79EC488BE3B9CEF14371B508626F969D11B1D7718965D664

Uniqueness

Uniqueness Score: -1.00%

Function 0054B990 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0054BB45
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0054BE47

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 8619c628930c15e3f64ee4185456f4c73d0beadc8a2f11204caef400f59f07bd
Instruction ID: a8910782226fa043b0ca02c89601bdb6306c66060be7ccd375e3029c486516c8
Opcode Fuzzy Hash: 8619c628930c15e3f64ee4185456f4c73d0beadc8a2f11204caef400f59f07bd
Instruction Fuzzy Hash: 0402A470604602AFEB14CF29C850BEABBE4FF88318F04866DE959C7650D774ED65CB92

Uniqueness

Uniqueness Score: -1.00%

Function 005041A0 Relevance: 1.9, Strings: 1, Instructions: 621COMMON

Download Yara Rule

Strings

~IP, xrefs: 00504326, 005048B9, 0050473E, 00504513, 005043EE, 00504367

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID:
String ID: ~IP
API String ID: 0-3959306736
Opcode ID: dbfb1a47ef4cf21015feb22a88fe898811b1a6b4d210efab5350a3fb83807d7f
Instruction ID: 0e36e89e1f9e1fd0a3757911ecfb7ec23bbf8a2227642b7cf3c9c86fbdf17ad5
Opcode Fuzzy Hash: dbfb1a47ef4cf21015feb22a88fe898811b1a6b4d210efab5350a3fb83807d7f
Instruction Fuzzy Hash: 4942CDB1A00649CBDB14CE78C8407ADFFA1FF46311F1886ADE5A5E7781D734994ACBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0043A8BD Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44be82ed036defe528c0ad6c951de0c396452293fa162e62365eb90ba0a48132
Instruction ID: 20f36868057f2dc5694f653adca667ab833700143c84c98609cf2c37f38438c9
Opcode Fuzzy Hash: 44be82ed036defe528c0ad6c951de0c396452293fa162e62365eb90ba0a48132
Instruction Fuzzy Hash: BEB1D37158060A8BCB28DE6885556BFB7A1AF0C304F142A1FD5D2A7381C73CAD65CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00506920 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162f077abf4ece743e342fc7a8eb5a3408877318c4d8ee47aeae2a44dea6da9b
Instruction ID: 21ea325e3d8e9dd88ad6d2e4823945e325a7d4879c9c0f24fc1850b01c051b63
Opcode Fuzzy Hash: 162f077abf4ece743e342fc7a8eb5a3408877318c4d8ee47aeae2a44dea6da9b
Instruction Fuzzy Hash: 10D19F70600B41CBE724CF39C45079ABBE0FF45314F148A6DD4EA8B781EB74A489CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00506DD0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae081eef026d20fb71c04ac6eddb48da90b3bd952cd5193e48f6a1899cdbfde1
Instruction ID: 7a6889ae545e6ec7e5da51a817b46c2a83bd4d4ff43436e387e76d31d11313cc
Opcode Fuzzy Hash: ae081eef026d20fb71c04ac6eddb48da90b3bd952cd5193e48f6a1899cdbfde1
Instruction Fuzzy Hash: 97B1B0756087019FC720CF68C840A6BBBE5FF88324F144B2DF8AAD3690D774EA558B52

Uniqueness

Uniqueness Score: -1.00%

Function 004E35A0 Relevance: 24.5, APIs: 16, Instructions: 493
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 004E35C8
RmStartSession.RSTRTMGR(?,00000000,?), ref: 004E3620
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 004E3657
RmGetList.RSTRTMGR(?,00000000,?,?,?), ref: 004E367F
RmShutdown.RSTRTMGR(?,00000001,00000000), ref: 004E36A0
RmEndSession.RSTRTMGR(?), ref: 004E36F9
SetLastError.KERNEL32(00000000), ref: 004E3700
CopyFileA.KERNEL32(?,?,00000000), ref: 004E371F
GetLastError.KERNEL32(?,?,00000000), ref: 004E372A
CopyFileA.KERNEL32(?,?,00000000), ref: 004E3742
RmStartSession.RSTRTMGR(?,00000000,?,?,00000000), ref: 004E37B1
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004E37E8
RmGetList.RSTRTMGR(?,?,?,?,?,?,00000000), ref: 004E3810
RmShutdown.RSTRTMGR(?,00000001,00000000,?,00000000), ref: 004E3830
RmEndSession.RSTRTMGR(?,?,00000000), ref: 004E387F
SetLastError.KERNEL32(00000000,?,00000000), ref: 004E3886

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ErrorLastSession$CopyFileListRegisterResourcesShutdownStart
String ID:
API String ID: 1315383477-0
Opcode ID: 5b55474738d83f2d7aff6c3ea50b44a912b227130379b68dc2329ae8cd5a13a6
Instruction ID: 5bf62267ccc7f4fe4693b81ad114fb0840f9afa76d5c815397b18ace0e574e84
Opcode Fuzzy Hash: 5b55474738d83f2d7aff6c3ea50b44a912b227130379b68dc2329ae8cd5a13a6
Instruction Fuzzy Hash: AC02AD71D00259AFCB15DFA5D888BEEBBB8FF08315F14022AE815A7391D7389E44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004D23C0 Relevance: 18.4, APIs: 12, Instructions: 351
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000370,0000FFFF,00001006,?,00000008), ref: 004D2466
recv.WS2_32(?,00000004,00000002), ref: 004D2481
WSAGetLastError.WS2_32 ref: 004D2485
recv.WS2_32(00000000,0000000C,00000002,0000000C), ref: 004D24EE
recv.WS2_32(00000000,0000000C,00000008), ref: 004D250F
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004D258B
recv.WS2_32(00000000,?,00000008), ref: 004D25AC

Part of subcall function 004D3150: WSAStartup.WS2_32 ref: 004D317A
Part of subcall function 004D3150: getaddrinfo.WS2_32(?,?,?,00588CC0), ref: 004D31FC
Part of subcall function 004D3150: socket.WS2_32(?,?,?), ref: 004D321D
Part of subcall function 004D3150: connect.WS2_32(00000000,0055F6D1,?), ref: 004D3231
Part of subcall function 004D3150: closesocket.WS2_32(00000000), ref: 004D323D
Part of subcall function 004D3150: freeaddrinfo.WS2_32(?,?,?,?,00588CC0,?,?), ref: 004D324A
Part of subcall function 004D3150: WSACleanup.WS2_32 ref: 004D3250

recv.WS2_32(?,00000004,00000008), ref: 004D27D6
__Xtime_get_ticks.LIBCPMT ref: 004D27DA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004D27E8
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 004D284F
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 004D285D

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: recv$Sleepsetsockopt$CleanupErrorLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectfreeaddrinfogetaddrinfosocket
String ID:
API String ID: 4125349891-0
Opcode ID: 0faf3052afb1c00782cdab9ebe53fd988e07a330ab3ea123e73c5a32e3e42a17
Instruction ID: 15ea99ae058cf58d21446cf462f8f8b9c5c04bab4b96d95aa166a16db5b48a04
Opcode Fuzzy Hash: 0faf3052afb1c00782cdab9ebe53fd988e07a330ab3ea123e73c5a32e3e42a17
Instruction Fuzzy Hash: 55E13230900244DFDB15DBA4CDA07ADBBF1BF66310F24425BE841AB2D2DBB45C8ADB95

Uniqueness

Uniqueness Score: -1.00%

Function 0043D563 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0043D21C: CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0043D239

GetLastError.KERNEL32 ref: 0043D677
__dosmaperr.LIBCMT ref: 0043D67E
GetFileType.KERNELBASE(00000000), ref: 0043D68A
GetLastError.KERNEL32 ref: 0043D694
__dosmaperr.LIBCMT ref: 0043D69D
CloseHandle.KERNEL32(00000000), ref: 0043D6BD
CloseHandle.KERNEL32(?), ref: 0043D80A
GetLastError.KERNEL32 ref: 0043D83C
__dosmaperr.LIBCMT ref: 0043D843

Strings

H, xrefs: 0043D7C8

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 63c00d4ff725a68de22716b4a375591cf024028e2c9fd4940c7fbe6601f7ac47
Instruction ID: deea7823187220b22c69116efca66525af397024c1424d0dae53dd4a9d4c69af
Opcode Fuzzy Hash: 63c00d4ff725a68de22716b4a375591cf024028e2c9fd4940c7fbe6601f7ac47
Instruction Fuzzy Hash: 47A17C31E14114AFCF19AF68EC467AE3BB1EB0A324F14215EF811DB391DB388816DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00421F3C Relevance: 16.4, APIs: 6, Strings: 3, Instructions: 635
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00422757
___std_exception_destroy.LIBVCRUNTIME ref: 00422770
___std_exception_destroy.LIBVCRUNTIME ref: 004228EF
___std_exception_destroy.LIBVCRUNTIME ref: 00422908
___std_exception_destroy.LIBVCRUNTIME ref: 00422B51
___std_exception_destroy.LIBVCRUNTIME ref: 00422B6A

Strings

$, xrefs: 00422D59
array, xrefs: 0042254B
object, xrefs: 00422B9E

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: $$array$object
API String ID: 4194217158-1261123851
Opcode ID: 5914cf778d6968e80494f709db4e8b77c064380b7e6a9d0f017eec3419c8f505
Instruction ID: 729c381a9a0c7f986160d18f999e66225a9d9459ed6648384f1f9576d23ff93e
Opcode Fuzzy Hash: 5914cf778d6968e80494f709db4e8b77c064380b7e6a9d0f017eec3419c8f505
Instruction Fuzzy Hash: 6642F370D0025DAFDB14DFA0D984BEEBBB4FF15304F50416EE405A7642EB78AA88CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004431A0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00443421, 00443424

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: b462a36e6bb30e1ebe37cca350b7bdb3d0fdcfd033a52d65a3f9a67cac222ce0
Instruction ID: e3239ec4e1ee32b8324d570a22e522ef24bddbe65fd960e714ad45a7b0e040b8
Opcode Fuzzy Hash: b462a36e6bb30e1ebe37cca350b7bdb3d0fdcfd033a52d65a3f9a67cac222ce0
Instruction Fuzzy Hash: 77B12670A04244AFEB01DF59C881BBE7BB1FF49715F14419AE90197382CB789E41CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041A800 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0041A959
___std_exception_destroy.LIBVCRUNTIME ref: 0041A972
___std_exception_destroy.LIBVCRUNTIME ref: 0041AB4E
___std_exception_destroy.LIBVCRUNTIME ref: 0041AB67

Strings

value, xrefs: 0041A8B3, 0041AAA2

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: value
API String ID: 4194217158-494360628
Opcode ID: e4ffa9d5168e7f9354265be0bc861305314de3187af35e75a45d650a850002be
Instruction ID: 9f034d729ebebe199f4f723a1c14bfd040db2caa5f80a11ca9a640f2ae4bdf80
Opcode Fuzzy Hash: e4ffa9d5168e7f9354265be0bc861305314de3187af35e75a45d650a850002be
Instruction Fuzzy Hash: 8DF10370D002488FDB14DF65C844BEEBBB4BF15304F14829EE455A7782E7786A88CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 381libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408127
GetProcAddress.KERNEL32(00000000,?), ref: 00408132
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000), ref: 0040814B

Strings

Ws2_32.dll, xrefs: 0040811E

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: dd4c487e8a8bc13902b4548fa43b40dbe95563e99cf8979a8f365f9e091ed4cc
Instruction ID: 4cf5a73f60aaa9aa04889aa359a8f1718852bcf292be34ef81f356f0aae57edb
Opcode Fuzzy Hash: dd4c487e8a8bc13902b4548fa43b40dbe95563e99cf8979a8f365f9e091ed4cc
Instruction Fuzzy Hash: 1FF18D70E042468FCB25CF58C880A6EBBB1BF45314F24456EE5A5AB3D2D7356C42CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 004081E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 332libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,005588D8,00000000,00000000,-00589220), ref: 00408566
GetProcAddress.KERNEL32(00000000,?), ref: 00408574
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,005588D8,00000000,00000000,-00589220), ref: 00408589

Strings

Ws2_32.dll, xrefs: 0040855A

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 56d94f30f56239b9f6a30b9d4a5a515b5cb323a29f0ba089c1967f76d3ef3ef0
Instruction ID: b889a33a35ddf0adef0218ac58701f77bdbbaba15cb1320cc4c9efeef27d22b6
Opcode Fuzzy Hash: 56d94f30f56239b9f6a30b9d4a5a515b5cb323a29f0ba089c1967f76d3ef3ef0
Instruction Fuzzy Hash: 1BE1BC70D00258EFDF15CBA4DD917EDBBB0AF56704F14029EE8857B282DB34198ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 00422441 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00422B51
___std_exception_destroy.LIBVCRUNTIME ref: 00422B6A

Strings

, xrefs: 004225C6
array, xrefs: 0042254B

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: $array
API String ID: 4194217158-2848110696
Opcode ID: 9f4ea02c731a21f36805351e2a343ddf98f006329fc53848230d514473e2f301
Instruction ID: 040f54a50eca916393071bfcf6e1f9d608c7cf8feb660a1d38d308300d53a661
Opcode Fuzzy Hash: 9f4ea02c731a21f36805351e2a343ddf98f006329fc53848230d514473e2f301
Instruction Fuzzy Hash: 1541F770D0425CEADB14DFA0D994BEEBBB8FF15304F50416FD401A7242DB786A88DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00446260 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(A{C,?,00437B41,?), ref: 00446268
GetLastError.KERNEL32(?,00437B41,?), ref: 00446272
__dosmaperr.LIBCMT ref: 00446279

Strings

A{C, xrefs: 00446265

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID: A{C
API String ID: 1545401867-2902953714
Opcode ID: d06e79dd3ba0cf7262f3e9d2e22031695f25905068d46e1a3810f42683731183
Instruction ID: 82298aed12121fbb76aae4bd86d3a8824ef8c8c9545724addf748e8f9a95ec58
Opcode Fuzzy Hash: d06e79dd3ba0cf7262f3e9d2e22031695f25905068d46e1a3810f42683731183
Instruction Fuzzy Hash: E2D02232018A093B8B002BFAFC0C81B3F1CDAC23B4B112212F12CC21A0DF79C880E540

Uniqueness

Uniqueness Score: -1.00%

Function 004F2CD0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,?,0055A5B3,000000FF), ref: 004F2D0C
GetLastError.KERNEL32(?,?,0055A5B3,000000FF), ref: 004F2D17
std::_Throw_Cpp_error.LIBCPMT ref: 004F2D4E
std::_Throw_Cpp_error.LIBCPMT ref: 004F2D5F

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: dfba1b075285273309578ffbf089447c7c1ac741728f75895561d4347c87bb62
Instruction ID: 325128bde6972141eaafbb0e95bf719766b08d5b5670bbe0189b29004b96e682
Opcode Fuzzy Hash: dfba1b075285273309578ffbf089447c7c1ac741728f75895561d4347c87bb62
Instruction Fuzzy Hash: 3401C071641118129A342A35ED4907F370D8713328BA80F1BEE25973D5D9DFCC45875A

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 308COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406029
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406070

Strings

., xrefs: 00406042

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 24110669fa94efa93dbf60294f552bae376b896653ba069dd2a2053fc70e762d
Instruction ID: 096b34988356738832717cd8d53d0dabcf9a03e197ae697f4c60f7eb60d7375d
Opcode Fuzzy Hash: 24110669fa94efa93dbf60294f552bae376b896653ba069dd2a2053fc70e762d
Instruction Fuzzy Hash: EBB1ED31A00A269FCB24DF28C484AABB3A5FF44314F14467AE956AB7C0D739AD55CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBAA Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040BF0B

Strings

gO>, xrefs: 0040BF95
D5I, xrefs: 0040BCE7

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: CreateDirectory
String ID: D5I$gO>
API String ID: 4241100979-9669375
Opcode ID: a70bc843fb75804f0c6dcccdee84c4d7299bd1d366e2e2686d92fec8723b3657
Instruction ID: 1c99b7db082cbe4170b2a8c48b056c73716a310fc73452a91fe799afa8dbbf6b
Opcode Fuzzy Hash: a70bc843fb75804f0c6dcccdee84c4d7299bd1d366e2e2686d92fec8723b3657
Instruction Fuzzy Hash: 38E14AB4D052588FCB64CF98DA91ADCBBF1AB4C324F6451A9E449B7340DB315E81CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040AED5 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 225fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040B094
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040B194

Strings

d:P, xrefs: 0040B21E

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: CopyCreateDirectoryFile
String ID: d:P
API String ID: 3761107634-1316356323
Opcode ID: 9834d24a3142c173cffbc2ab538e9bcef5bf588c3bed871f4eefa6fbed3306b3
Instruction ID: b46fb8f498fe19e45c2de27f9ae2aa4bcfe055eec9d79a59652231d92f533978
Opcode Fuzzy Hash: 9834d24a3142c173cffbc2ab538e9bcef5bf588c3bed871f4eefa6fbed3306b3
Instruction Fuzzy Hash: C0D17BB8D052588BDB25CF98D991ADCBBF0AB4C314F2451DAE809B7340DB316E84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5CC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040C78B
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040C88B

Strings

, xrefs: 0040C692

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: CopyCreateDirectoryFile
String ID:
API String ID: 3761107634-3916222277
Opcode ID: 6230a3c5e97c4a67157d6a67fc00dc778ed06bd17ee8d2d2cab1e9c77b27c71c
Instruction ID: fea31fcc1739ab290db98ead6b4672fbdfba05a45897d1c47918ee6387bb05c2
Opcode Fuzzy Hash: 6230a3c5e97c4a67157d6a67fc00dc778ed06bd17ee8d2d2cab1e9c77b27c71c
Instruction Fuzzy Hash: D6D17AB8D052588BDB28CF98D991ADCBBF0AF58324F2411E9D809B7340DB315E84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00447C50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156timeCOMMON

Download Yara Rule

APIs

Part of subcall function 004458AA: RtlFreeHeap.NTDLL(00000000,00000000,?,0044C3D9,?,00000000,?,?,0044C67A,?,00000007,?,?,0044CB6E,?,?), ref: 004458C0
Part of subcall function 004458AA: GetLastError.KERNEL32(?,?,0044C3D9,?,00000000,?,?,0044C67A,?,00000007,?,?,0044CB6E,?,?), ref: 004458CB

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00447E03,00000000,00000000,00000000), ref: 00447CC2

Strings

W. Europe Summer Time, xrefs: 00447D6F
W. Europe Standard Time, xrefs: 00447D5B

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 3335090040-690618308
Opcode ID: 53cfa0c2b2e8e1c4497564ba13a148606d804052baa25eea3ebd75a2ff8e0b0f
Instruction ID: 95fec9e7b2ee5416ea09e91f5883e66808fc8b830f7b48389ead0be8655ac52d
Opcode Fuzzy Hash: 53cfa0c2b2e8e1c4497564ba13a148606d804052baa25eea3ebd75a2ff8e0b0f
Instruction Fuzzy Hash: 7641D471D04225ABEB10BF76DC0696E7FB8EF04358F60415BF814B7291EB389D069B98

Uniqueness

Uniqueness Score: -1.00%

Function 004F8D20 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 250COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004F8DF9

Strings

-2L, xrefs: 004F8E0D
-1L, xrefs: 004F8EAA

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ErrorLast
String ID: -1L$-2L
API String ID: 1452528299-3975959154
Opcode ID: 7cbc2765ffe9876f453631ab618cea2cdf271d2230653e7288edc8667744d0af
Instruction ID: 8532e58cabc42239c9a206463210862c2cf1955d45b676afb1905f123e481057
Opcode Fuzzy Hash: 7cbc2765ffe9876f453631ab618cea2cdf271d2230653e7288edc8667744d0af
Instruction Fuzzy Hash: 8BA1A071E102489BDB18DBA4CC95BFEB771FF58304F14821EE905BB281EB746A85CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA6A Relevance: 4.7, APIs: 3, Instructions: 227fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040AB87
CreateDirectoryA.KERNELBASE(00000000,00000000,?), ref: 0040ACD3
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040ADA3

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: CreateDirectory$CopyFile
String ID:
API String ID: 379462554-0
Opcode ID: aa0bf1944e415d055ad1ba2bd394d683157b89170457a394d18422a3be082895
Instruction ID: fa5d3aefcb5318aac483c8dab34aecfa374d65c0e00a15c095fa280417b77c72
Opcode Fuzzy Hash: aa0bf1944e415d055ad1ba2bd394d683157b89170457a394d18422a3be082895
Instruction Fuzzy Hash: EEC1CEB8D042188ADB25DF98C991ADDBBF0AF5C324F1411E9D809B7380DB356E84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004F2C70 Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 004F2C92

Part of subcall function 0042D43A: ReleaseSRWLockExclusive.KERNEL32(004F2D39), ref: 0042D44E

std::_Throw_Cpp_error.LIBCPMT ref: 004F2CAD
std::_Throw_Cpp_error.LIBCPMT ref: 004F2CBE

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryExclusiveLockRelease
String ID:
API String ID: 1881651058-0
Opcode ID: 0347d829a5eb11eae45fe4e31cdd857bf971855d4b8e6105c880f95a0e06c83c
Instruction ID: 605f2016e10b7e18b163202c4e2c4cdd5dfa79e1876f0762e61eb7d28960231e
Opcode Fuzzy Hash: 0347d829a5eb11eae45fe4e31cdd857bf971855d4b8e6105c880f95a0e06c83c
Instruction Fuzzy Hash: 08E0D872B4422062D52033367C0763B254C8B11324FD4063AFE20A61D1EDF998048B8A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B362 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 211fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040B5A7

Strings

bV#, xrefs: 0040B646

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: CopyFile
String ID: bV#
API String ID: 1304948518-2557208531
Opcode ID: 2e174e6643ddc55f21fd3496af49bc0eec1a3949b4a986039ec58223d0844ec1
Instruction ID: cae23ce53105954d6f992f15396b4822f88a54db382455c53f0dce72c0814f2e
Opcode Fuzzy Hash: 2e174e6643ddc55f21fd3496af49bc0eec1a3949b4a986039ec58223d0844ec1
Instruction Fuzzy Hash: 2BC18DB4D052598FCB25CF98DA916DCBBF1AB4C324F2451AAD809B7340DB356E81CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040C155 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040C49A

Strings

U5I, xrefs: 0040C4E4

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: CreateDirectory
String ID: U5I
API String ID: 4241100979-2587217555
Opcode ID: c096f63529a2d04bfeae6dc2135d5aab1f1a4f86739ed3dadbb568acd2f4c664
Instruction ID: ac674b7b51f05a57ce70314e7f00a6b42712f57d929c2611c6f576c432607ed5
Opcode Fuzzy Hash: c096f63529a2d04bfeae6dc2135d5aab1f1a4f86739ed3dadbb568acd2f4c664
Instruction Fuzzy Hash: A4C16BB4D052188FDB24CF98DA91ADCBBF1AB4C324F645199E809B7340DB316E85CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040E250 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 004F2CD0: GetFileAttributesA.KERNELBASE(?,?,?,0055A5B3,000000FF), ref: 004F2D0C
Part of subcall function 004F2CD0: GetLastError.KERNEL32(?,?,0055A5B3,000000FF), ref: 004F2D17

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040E459

Strings

=, xrefs: 0040E38E

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: AttributesCreateDirectoryErrorFileLast
String ID: =
API String ID: 674977465-2322244508
Opcode ID: c01e006192443c623b1345774e7bd4ae881e867d2a563e42cd0be2be54deea90
Instruction ID: 4c31c2b4ab6c20c136918818f105c81bd143b56d6cc430cbfc3e2680d29ed538
Opcode Fuzzy Hash: c01e006192443c623b1345774e7bd4ae881e867d2a563e42cd0be2be54deea90
Instruction Fuzzy Hash: 2091F2B4D1526C9BDB25CFA9E981ADCFBB4BF48304F00819AE858B7341DB346A84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00433692 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

d A, xrefs: 00433694

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID:
String ID: d A
API String ID: 0-616623946
Opcode ID: eede66d756e0c1a0b5e07baf9b01a7231fde42cae16d6e993eff2dc43bb1a5b1
Instruction ID: 8d691b3f4dbeef2f936747217c2848be1b4780fc272094865f28ed7dea4c0760
Opcode Fuzzy Hash: eede66d756e0c1a0b5e07baf9b01a7231fde42cae16d6e993eff2dc43bb1a5b1
Instruction Fuzzy Hash: 7B51E3B4A00104AFDB14DF59CC85AAABBF1EF4D324F24915AF8099B352D379EE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00410887 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 004108A1

Strings

k, xrefs: 00410895

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: CreateDirectory
String ID: k
API String ID: 4241100979-140662621
Opcode ID: c404385334f48e69bc3d99d72a58cc6b4349818a5b857a9d5148564d291bfd69
Instruction ID: 1f0ba2e685299aad9cd7c917c7bb047ec0820a6efdb3c6e343f4a662026f26a4
Opcode Fuzzy Hash: c404385334f48e69bc3d99d72a58cc6b4349818a5b857a9d5148564d291bfd69
Instruction Fuzzy Hash: 68417BB4D05268DBCB28CF99E990ADCFBB1FB48304F4081AAE819B7350DB746941CF45

Uniqueness

Uniqueness Score: -1.00%

Function 004D2890 Relevance: 3.6, APIs: 2, Instructions: 560COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,6F2977B7,?,?,?,?,?,?,?,00000000,00000001,76A923A0,00000000), ref: 004D2D54

Part of subcall function 004DB380: VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040,?,00000000), ref: 004DB3EA
Part of subcall function 004DB380: WriteProcessMemory.KERNEL32(00000000,00000000,t-M,?,00000000), ref: 004DB406
Part of subcall function 004DB380: WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 004DB43F
Part of subcall function 004DB380: VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 004DB469

Part of subcall function 0042D43A: ReleaseSRWLockExclusive.KERNEL32(004F2D39), ref: 0042D44E

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Process$AllocMemoryVirtualWrite$CurrentExclusiveLockRelease
String ID:
API String ID: 666592346-0
Opcode ID: c56c19362e8dfe9c929ab92c0b654e71572474fde41903893849a7495f35d764
Instruction ID: 26b9c72b6ddc4c31c1f3b4b91af9721e671e16450a7e1798ce2a3c04c8b5f315
Opcode Fuzzy Hash: c56c19362e8dfe9c929ab92c0b654e71572474fde41903893849a7495f35d764
Instruction Fuzzy Hash: 7432DF70900208CBDB14DF68C9957EDBBB1FF58304F14419AE8096B392DB789E85CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00444019 Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0044372F: GetConsoleOutputCP.KERNEL32(8D5902D8,00000000,00000000,00437957), ref: 00443792

WriteFile.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,?,004F2E1F,?,00437877,004F2E1F,?,00578900,00000010,00437957), ref: 0044419E
GetLastError.KERNEL32(?,00437877,004F2E1F,?,00578900,00000010,00437957,004F2E1F,?,00000000,?), ref: 004441A8

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 66e0ddea0cb217b6ae80d1a32b3b59e934d250a7623237bbde176196d2ee28a3
Instruction ID: 0628d0172fcac0a10c399004d6184d52a202fa31f39ed19b8586a1ab0f8a80ff
Opcode Fuzzy Hash: 66e0ddea0cb217b6ae80d1a32b3b59e934d250a7623237bbde176196d2ee28a3
Instruction Fuzzy Hash: 2B61C471900119AFEF11CFA8DC84BEFBBB9BF99304F14014AE900A7202D779D955DB65

Uniqueness

Uniqueness Score: -1.00%

Function 004122A0 Relevance: 3.2, APIs: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0041243B
__fread_nolock.LIBCMT ref: 0041245D

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: a6de1df37dfb96f7904da2523f795a48f12aff5b6393de5a7868983c18ffdd9b
Instruction ID: b5ec34bd29a15183def94e688a440539f4bf7795f8ca6c39a07d260135894a7b
Opcode Fuzzy Hash: a6de1df37dfb96f7904da2523f795a48f12aff5b6393de5a7868983c18ffdd9b
Instruction Fuzzy Hash: 82615B326042058FCB18CF2DD9809AA77E1EF88720F05866EFC58CB345E775DC698B99

Uniqueness

Uniqueness Score: -1.00%

Function 00407B10 Relevance: 3.1, APIs: 2, Instructions: 114COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,7FFFFFFF,?,?,?,?,00000000,00558869,000000FF,?,?,00000000,00000001), ref: 00407B6A
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000,00558869,000000FF,?,?,00000000), ref: 00407BF2

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: d08a96d9c25024a750445a24f33408e8c4088889fc05b13ee24b34efa54571e3
Instruction ID: 2e2c2f2e01908e67c2a54bf0340a0c4501e43c5477e127a6dc49a8083d671767
Opcode Fuzzy Hash: d08a96d9c25024a750445a24f33408e8c4088889fc05b13ee24b34efa54571e3
Instruction Fuzzy Hash: 2641F175E14601EFC720DF64EC42AAAB7B5FB54724F18032AE816633D0E7347944DB96

Uniqueness

Uniqueness Score: -1.00%

Function 0044368F Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00443576,00000000,CF830579,00578C68,0000000C,00443632,0043790D,?), ref: 004436E5
GetLastError.KERNEL32(?,00443576,00000000,CF830579,00578C68,0000000C,00443632,0043790D,?), ref: 004436EF

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: b78c23c39475fb946a6917cc79ada02ff23f82b2eae8cc914a7116fd1dd25ee2
Instruction ID: 5b9e54e71ebf2813978f3334a6ac8d2e590d94fd15b88a1802dc34040f0fcd9e
Opcode Fuzzy Hash: b78c23c39475fb946a6917cc79ada02ff23f82b2eae8cc914a7116fd1dd25ee2
Instruction Fuzzy Hash: 0B118C326041153AF6302A34AC4DB3F67898B82F39F26014FF908873C2DE6D8D409658

Uniqueness

Uniqueness Score: -1.00%

Function 0043CDAC Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00437957,00000000,00000002,00000000,00000000,00000000,00000000,?,0043CEE6,00000000,00000000,00437957,00000002,00000000), ref: 0043CDE8
GetLastError.KERNEL32(00000000,?,0043CEE6,00000000,00000000,00437957,00000002,00000000,?,004440BE,00000000,00000000,00000000,00000002,00437957,00000000), ref: 0043CDF5

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0af088d07c5e9b5a66b5e22e0931705f94c426e6b0292fcf303bea830e5f1f74
Instruction ID: 056746620e1e5b2230fb06e89194d4bad5ac0bf9516e57b03a2b19a767fcc837
Opcode Fuzzy Hash: 0af088d07c5e9b5a66b5e22e0931705f94c426e6b0292fcf303bea830e5f1f74
Instruction Fuzzy Hash: 62012632614119AFCF058F59CC49D9E3F2AEF89320F24020AF811AB2D0EA75ED41DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00405D90 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00405D9E

Part of subcall function 0042C80A: FindNextFileW.KERNELBASE(?,?,?,00405DA3,?,?), ref: 0042C813

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00405DB7

Part of subcall function 0042C80A: GetLastError.KERNEL32(?,00405DA3,?,?), ref: 0042C821

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ___std_fs_directory_iterator_advance@8$ErrorFileFindLastNext
String ID:
API String ID: 1771861590-0
Opcode ID: eb254d40bdae5997d1b915ee938d47a4925237b4d84c79f510e65dea7e6ef008
Instruction ID: 0108473d78f0f304d06e31c26ecc01ded597c2f8cb716c03f48c3c202a603d91
Opcode Fuzzy Hash: eb254d40bdae5997d1b915ee938d47a4925237b4d84c79f510e65dea7e6ef008
Instruction Fuzzy Hash: 02E09232200A212299503513AD055EFAB5EEE913A4740403BFA05A7781EB38EC1285E9

Uniqueness

Uniqueness Score: -1.00%

Function 004458AA Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0044C3D9,?,00000000,?,?,0044C67A,?,00000007,?,?,0044CB6E,?,?), ref: 004458C0
GetLastError.KERNEL32(?,?,0044C3D9,?,00000000,?,?,0044C67A,?,00000007,?,?,0044CB6E,?,?), ref: 004458CB

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: faeb12ccb0e26dc965f9d80f3c1b711b705900c11bc95a42bd6c0ce8c2310291
Instruction ID: 23237336ed7649a93a226213d1d5fd37ccb1674bfa2126fe5f49bd5de7ec7b5d
Opcode Fuzzy Hash: faeb12ccb0e26dc965f9d80f3c1b711b705900c11bc95a42bd6c0ce8c2310291
Instruction Fuzzy Hash: 75E086315006146BDB113FB9EC0DBAA3BA8EB44355F519026F709D7161CF788854D7C8

Uniqueness

Uniqueness Score: -1.00%

Function 004D1860 Relevance: 2.0, APIs: 1, Instructions: 549fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNELBASE(?), ref: 004D1911

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: a0a35e922f4f0a70ad5e3bab5b3892ac09c1540c5f8475580bdb878dc4288fc7
Instruction ID: 595fb68b70b26d2d20b0dfc54c8cde64091a38ddc6938181b846cdeea2eef5ff
Opcode Fuzzy Hash: a0a35e922f4f0a70ad5e3bab5b3892ac09c1540c5f8475580bdb878dc4288fc7
Instruction Fuzzy Hash: 3C22C1B0D002099FCB14DFA8D995BAEBBB1FF48304F14825EE805AB352D734AA45CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00425390 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004254A7

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6463476b976481346b0f1093190228b31a5fd325bfddd8a922556d8987916ca0
Instruction ID: c4b725e649f7e58322d65e55cd69c4218f7731d497adffb4160b667c7d72a65a
Opcode Fuzzy Hash: 6463476b976481346b0f1093190228b31a5fd325bfddd8a922556d8987916ca0
Instruction Fuzzy Hash: D7810372700515AFC708EF38E98597EB7A9EF443207A4832EE819C7385EA34EE55C794

Uniqueness

Uniqueness Score: -1.00%

Function 004119D0 Relevance: 1.7, APIs: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00411CA5

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: aabfa15b1065b528361af71ed1f78f970e6589b199b2026b60074c120a1ed7d3
Instruction ID: a9115b42fecf8998d40f26f04e050bc50794b9bc8bc91804c339519e047c10bd
Opcode Fuzzy Hash: aabfa15b1065b528361af71ed1f78f970e6589b199b2026b60074c120a1ed7d3
Instruction Fuzzy Hash: 86A13AB0900215DFDB04CF69C580B99FBF0BF09314F28C1AEE549AB352E779A985CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004F3550 Relevance: 1.7, APIs: 1, Instructions: 170COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004F36E5

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 94468eb9081900363dfd662bc71926861537d4ac9132e76e5d5add44549b5d1d
Instruction ID: 32bcb13d06159bcbf1e711c284ff9f9cb594162b32a10293023583a718d1283d
Opcode Fuzzy Hash: 94468eb9081900363dfd662bc71926861537d4ac9132e76e5d5add44549b5d1d
Instruction Fuzzy Hash: 8C51A1B0D002099FDB14DF59D981BAEFBB0FF49704F14825EE8046B342D7799A41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004F3350 Relevance: 1.7, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004F34EF

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: b69ec9a415716678f392a8959026dd82b3597fb433f0346b2d751f9f8bbfdb4e
Instruction ID: 6ce4f48939319f72f3aec6a6d9b50e6fff9bcb1e6f6dae555552d8831335830b
Opcode Fuzzy Hash: b69ec9a415716678f392a8959026dd82b3597fb433f0346b2d751f9f8bbfdb4e
Instruction Fuzzy Hash: 2551A0B0D002099FDB14DF59D981BAEFBB0FF49704F14825EE8146B341E779AA41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004F3750 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004F38B5

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1c393b77a678177202ae0a4b35ab124da8259f0f62cb0e23b0d2acb6517c6524
Instruction ID: cd4a1da141f317168313a104556b472c5763c058f69814c45053fc560e84e052
Opcode Fuzzy Hash: 1c393b77a678177202ae0a4b35ab124da8259f0f62cb0e23b0d2acb6517c6524
Instruction Fuzzy Hash: 6A5180B0D002099BDB24DF59D982BAEFBF0FF44714F14061EE5416B341D779AA44CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00405AD0 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00405BB1

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ___std_fs_directory_iterator_open@12
String ID:
API String ID: 29801545-0
Opcode ID: f696d6151f309be9193cc7c85e873ba70de42943ce5765209a9c4d3a5a8c60fc
Instruction ID: d5a1cf4f232f5c6ac5430c54351a6ee74597bd081f23ad9fa31e924e3bde2b96
Opcode Fuzzy Hash: f696d6151f309be9193cc7c85e873ba70de42943ce5765209a9c4d3a5a8c60fc
Instruction Fuzzy Hash: 8741CF72E146049BDB18DF49D8817AEB7B4FB84320F14466AEC11637C1EB397D50CA95

Uniqueness

Uniqueness Score: -1.00%

Function 00408980 Relevance: 1.6, APIs: 1, Instructions: 108libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000000), ref: 00408A31

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e778ac258585310e7fe4938e31092008cd6e18a3a51d75130e0cc209c0f13ca7
Instruction ID: d2c8f323ac81831e6b5d26602da7a52bd27c9e45b28783f3ac091e4753249403
Opcode Fuzzy Hash: e778ac258585310e7fe4938e31092008cd6e18a3a51d75130e0cc209c0f13ca7
Instruction Fuzzy Hash: DD514AB8D05218EBDB14CF98DA90ADDFBB1BB48350F2081AAD849B7340DB306B84DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1C0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0041A23C

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2c84c2b0e743d94a5817f271001594ec1067e0da77e27549a2bd472c2b57b4ad
Instruction ID: 860ce97b332fb9d1e031327c07cea4d064aa7b2201825034e64e2daf926a64eb
Opcode Fuzzy Hash: 2c84c2b0e743d94a5817f271001594ec1067e0da77e27549a2bd472c2b57b4ad
Instruction Fuzzy Hash: 5A018572A010205F9B10AFA9CD828AB3798CF49354701427BF906CB342D639EDA483EF

Uniqueness

Uniqueness Score: -1.00%

Function 0044550F Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00445549

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 74b1a02970c39c47b45041c200990e685aac7fc35223ed5dd6a5c291d0407c3c
Instruction ID: e92d0ab7a98c68cd7689e4ea664d55cb742e11440dbe97f573872f5ababe4450
Opcode Fuzzy Hash: 74b1a02970c39c47b45041c200990e685aac7fc35223ed5dd6a5c291d0407c3c
Instruction Fuzzy Hash: D6112A71A0410AAFDF05DF58E94199F7BF5EF48304F14405AF805EB352D670DA15CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004036F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040373F

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 12c324e41fe382e8fe9a14f23e64098c2d41453202b30a4ddcfc1465a6711afe
Instruction ID: 1f83190ccb7284a945d627c352a8af0deec80e54417847a9b28e6d6de5687d5d
Opcode Fuzzy Hash: 12c324e41fe382e8fe9a14f23e64098c2d41453202b30a4ddcfc1465a6711afe
Instruction Fuzzy Hash: F6F024F26000009BCB14AF61E4429FAB7ECDE243A7750447FF989D7282E73EDA448788

Uniqueness

Uniqueness Score: -1.00%

Function 00444EEA Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,0042C58A,00417EFF,?,00444870,00000001,00000364,00417EFF,00000008,000000FF,?,0042F3CF,00417EFD,00417EFB,?,?), ref: 00444F2B

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a67815bf3a869f96681a983d491eb3b40caf69aff6fa6519728d0dfc96a736c8
Instruction ID: 086544c5e523b8e02c2757f3417cf7e9bd7439c420b709eac9e7cfb6d4d974b4
Opcode Fuzzy Hash: a67815bf3a869f96681a983d491eb3b40caf69aff6fa6519728d0dfc96a736c8
Instruction Fuzzy Hash: CEF0B4316155246BBB215E629C05B7B7788ABD17A1F158417FD04E7280CE38D80886E9

Uniqueness

Uniqueness Score: -1.00%

Function 004F1F00 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(00562560,00000000,00000000,00000012), ref: 004F1F17

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: bdd51cae4c084c57fcc4901e949a17f5d6d576fa70ecaa2978942f43ecf13d9a
Instruction ID: bee270daeaff66964e48d3d321f2ef6a0a83fe545a7604eea2b81030ab9a0a7d
Opcode Fuzzy Hash: bdd51cae4c084c57fcc4901e949a17f5d6d576fa70ecaa2978942f43ecf13d9a
Instruction Fuzzy Hash: E4F0E970B1071857D3309F28AC05357BBE49B51B14F10075EF5458B3C1E7F5699853D6

Uniqueness

Uniqueness Score: -1.00%

Function 00445924 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00417EFF,00417EFB,?,0042F3CF,00417EFD,00417EFB,?,?,?,0040390D,0042C58A,00417EFF,00417EFB,0042C58A), ref: 00445956

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f2b14cbab143d06f1f7f7dbb6931a5cb890e65deebc000058d543e0d14a0fef9
Instruction ID: 47241cb67a9c7b30d4e0b830f1b418076ccf533a730137c1b779a77b3e9f7ccf
Opcode Fuzzy Hash: f2b14cbab143d06f1f7f7dbb6931a5cb890e65deebc000058d543e0d14a0fef9
Instruction Fuzzy Hash: 1CE0E571202A20EBFE252F265C0576B3648DB413B0F080113FD05F6292DB68CC0482ED

Uniqueness

Uniqueness Score: -1.00%

Function 00405AA0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00405AB3

Part of subcall function 0042C80A: FindNextFileW.KERNELBASE(?,?,?,00405DA3,?,?), ref: 0042C813

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: 81b8d4adac4151a37c88ea3531144291c0ed1dde65bf57112f3d275560818ac6
Instruction ID: f6ea285aba16a13ea3ec76640246895ff5761922bd5c6c82d3b00af4906e1a90
Opcode Fuzzy Hash: 81b8d4adac4151a37c88ea3531144291c0ed1dde65bf57112f3d275560818ac6
Instruction Fuzzy Hash: BED0A721300930115E65712738405FF4A5ACED2778B04017FB904F33C2EA2C4C038CED

Uniqueness

Uniqueness Score: -1.00%

Function 00440F65 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00440F6C

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 6a1e62305c3acb8e5222b1c12e093a7fef9c21457bd0ab900d0622aaa7e19f4a
Instruction ID: aff0934107e9bc2afc1ed01947bee51e3b082187fcc3c1abf97fb91d30d5be1b
Opcode Fuzzy Hash: 6a1e62305c3acb8e5222b1c12e093a7fef9c21457bd0ab900d0622aaa7e19f4a
Instruction Fuzzy Hash: 95E09A72D0020D9ADB00DFD5D456BEFBBB8AB08314F50416BA605E7181EB785748CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0043D21C Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0043D239

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a91d23867b62d5b96c41623edd2e8bd3ad87182c46de236b94739b51406d3068
Instruction ID: 7ae74b51c889a2cb05e6a06522f477e8d6926b4a8c7f3733491aa3a38d366a2c
Opcode Fuzzy Hash: a91d23867b62d5b96c41623edd2e8bd3ad87182c46de236b94739b51406d3068
Instruction Fuzzy Hash: 92D06C3200010DBBDF028F84DC06EDA3BAAFB4C714F014040FA1866120C772E822EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00408FE1 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(6C210000), ref: 00408FF3

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: e1b8b5312981e26a60b0176e6b126c99adc267963dcf4990b13cab83b377898a
Instruction ID: 490db17b99ce191f58a9b4e04f03cf5ce589e7a007bfd414fe16c1c7cc511007
Opcode Fuzzy Hash: e1b8b5312981e26a60b0176e6b126c99adc267963dcf4990b13cab83b377898a
Instruction Fuzzy Hash: 23C012680082C29BCB0693358848365AE00AF23218F8804AE8880A66D3CDA94008DB15

Uniqueness

Uniqueness Score: -1.00%

Function 004D2040 Relevance: 1.3, APIs: 1, Instructions: 33sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,00458D52), ref: 004D2093

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 83f2b2eca9ec0b48552a48ca10ae59a4487ce3495c761ca9039c3b03c55a5e39
Instruction ID: 5725677e75a6ac36c440eb726a8cd5388f75a9debdf55df4042df7e65aebbe00
Opcode Fuzzy Hash: 83f2b2eca9ec0b48552a48ca10ae59a4487ce3495c761ca9039c3b03c55a5e39
Instruction Fuzzy Hash: 20F0E221A0025016EA22B2792D0673A3F85A7A6724F48018BEF423B7D2DAD82D0983D6

Uniqueness

Uniqueness Score: -1.00%

Function 004D20B0 Relevance: 1.3, APIs: 1, Instructions: 33sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000065), ref: 004D2103

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 35fb44faf0a8fc100d841d81db4c77c8e28ab7600db3ad407436fbe4614108cb
Instruction ID: 16727208b5f08e4bea599353fbf53a6d413f31fbfb73884cdf8f34aab55cbcc4
Opcode Fuzzy Hash: 35fb44faf0a8fc100d841d81db4c77c8e28ab7600db3ad407436fbe4614108cb
Instruction Fuzzy Hash: B8F0A731B0025416EA26736D7E06B3B3F8997A5765F48009FEE403BBD2DDD9280987D6

Uniqueness

Uniqueness Score: -1.00%

Function 004D2120 Relevance: 1.3, APIs: 1, Instructions: 33sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000065,?,?,?,?,?,?,?,?,?,?,?,00458D4D), ref: 004D2173

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: cb4445f8f23e35d184d7bbbb276354b3f66d002ad20050ef745446d9cc5894b3
Instruction ID: 90a6c49b21b0fd82ae87a0f264113b7d17b526517561dc18198510732a1b952e
Opcode Fuzzy Hash: cb4445f8f23e35d184d7bbbb276354b3f66d002ad20050ef745446d9cc5894b3
Instruction Fuzzy Hash: 53F0E225A0024016EA21B26D2D07B3B3FA587E5724F48008BEE403B7E2E998690D93D6

Uniqueness

Uniqueness Score: -1.00%

Function 004D1F60 Relevance: 1.3, APIs: 1, Instructions: 33sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000065), ref: 004D1FB3

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8cc8233da0b4eadc4345afef26914da44cd989e3a36f9e64d21921473576aba7
Instruction ID: 96813e4978320da69047605bdc5ebc2db0ede144c46c0996891fef61e0d73129
Opcode Fuzzy Hash: 8cc8233da0b4eadc4345afef26914da44cd989e3a36f9e64d21921473576aba7
Instruction Fuzzy Hash: F1F02731B0425026EA25736D7D06B3A3F858795724F48018FED002BBE3DE99280987D7

Uniqueness

Uniqueness Score: -1.00%

Function 004D1FD0 Relevance: 1.3, APIs: 1, Instructions: 33sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,00458D57), ref: 004D2023

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 023d8daf2c2feeef625063db40c37107e19a346fd89d2fc77cc72de507247420
Instruction ID: 649beb9cb224a865d551f479db4d9118ca68f30c140776fc94dbe4ded046f890
Opcode Fuzzy Hash: 023d8daf2c2feeef625063db40c37107e19a346fd89d2fc77cc72de507247420
Instruction Fuzzy Hash: 76F0E921A4224016DA2272693D067363F8587A5764F04104FEF00377D2D9D42809C7D6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004F2150 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 154windowfileCOMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(?,0045A92C,00000000,7FFFFFFF,?), ref: 004F2189
GetSystemMetrics.USER32(00000001), ref: 004F219F
GetSystemMetrics.USER32(00000000), ref: 004F21A5
GetDC.USER32(00000000), ref: 004F21AB
CreateCompatibleDC.GDI32(00000000), ref: 004F21BF
CreateCompatibleBitmap.GDI32(00000000,00000000,00000000), ref: 004F21D3
SelectObject.GDI32(?,00000000), ref: 004F21E8
BitBlt.GDI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00CC0020), ref: 004F2201
GdipCreateBitmapFromHBITMAP.GDIPLUS(00584418,00000000,00000000), ref: 004F2217
GdipGetImageEncodersSize.GDIPLUS(00000000,?), ref: 004F2233
GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 004F225A
GdipSaveImageToFile.GDIPLUS(00000000,6F2977B7,?,?), ref: 004F22FD
DeleteObject.GDI32(00584418), ref: 004F2306
GdipDisposeImage.GDIPLUS(00000000), ref: 004F230D
DeleteObject.GDI32(?), ref: 004F2316
ReleaseDC.USER32(00000000,00000000), ref: 004F231F
GdiplusShutdown.GDIPLUS(?), ref: 004F2328

Strings

image/png, xrefs: 004F2272

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Gdip$Image$CreateObject$BitmapCompatibleDeleteEncodersGdiplusMetricsSystem$DisposeFileFromReleaseSaveSelectShutdownSizeStartup
String ID: image/png
API String ID: 258367123-2966254431
Opcode ID: fb1bbdcbdec57114dd12a1ee1549e3a4fa01625a0ff2eb2c6bcf6a3c4bb0fd9d
Instruction ID: db5a99caf6ac0e95f343f652cfce475829ccb6d2aa326760d5af157a7b9552c8
Opcode Fuzzy Hash: fb1bbdcbdec57114dd12a1ee1549e3a4fa01625a0ff2eb2c6bcf6a3c4bb0fd9d
Instruction Fuzzy Hash: C8516D71D00209AFDF109FA4DD49BEEBBB8FF18314F100065EA05B72A1D7B99948DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0044F050 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0044F267

Strings

1#INF, xrefs: 0044F186
1#QNAN, xrefs: 0044F163
1#SNAN, xrefs: 0044F15C
1#IND, xrefs: 0044F155

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: da9375122c7f38aef1b98b42bf48e098612be30453a2df058743415e8865b902
Instruction ID: 19b2b9832e91dc5334225f28d461ebb5f9cd7fa0aaab348ffad5a30d2ce72a94
Opcode Fuzzy Hash: da9375122c7f38aef1b98b42bf48e098612be30453a2df058743415e8865b902
Instruction Fuzzy Hash: 0FD23971E086288FDB64CE28DD447EAB7B5EB45305F1401EBD80DE7241EB78AE898F45

Uniqueness

Uniqueness Score: -1.00%

Function 004E2080 Relevance: 4.7, APIs: 3, Instructions: 219COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004E20A0
IsProcessorFeaturePresent.KERNEL32(00000015), ref: 004E20AC
GetVolumeInformationA.KERNEL32(?,?,00000105,?,?,?,?,00000105), ref: 004E215F

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Present$DebuggerFeatureInformationProcessorVolume
String ID:
API String ID: 3535182753-0
Opcode ID: 623aa9994b68ff213dbe910c545f283b358e46525878ba29fffe8422486bf1ad
Instruction ID: afbfdc60606ab1e9c61f519775a33832b97aa9882633c04701562a7ea04b081c
Opcode Fuzzy Hash: 623aa9994b68ff213dbe910c545f283b358e46525878ba29fffe8422486bf1ad
Instruction Fuzzy Hash: C0B103B8D0424CEBCB25CFA5DA81AEDBBB5BF19304F2441DAD885AB341EB315A44DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00553170 Relevance: 3.5, APIs: 2, Instructions: 465COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00553513
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00553571

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: d6ef0b778412603ae4375fe8f4b2b868cc24e55a123d3fdd18dfd41b4726deb8
Instruction ID: 3fbf31a8c3cdee1091fcfc22b4047fc9f3449861c1a85ea422063c13361c5e55
Opcode Fuzzy Hash: d6ef0b778412603ae4375fe8f4b2b868cc24e55a123d3fdd18dfd41b4726deb8
Instruction Fuzzy Hash: 7802F571E006598BCF19CF6DD8A42BDFFB1BF85351F1982ABE859AB281DB704A44C740

Uniqueness

Uniqueness Score: -1.00%

Function 004FA050 Relevance: 3.2, APIs: 2, Instructions: 220networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 004FA262
InternetCloseHandle.WININET(?), ref: 004FA271

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: CloseHandleInternet
String ID:
API String ID: 1081599783-0
Opcode ID: fd654fbc9e612cb654ed9e4d8faceb9001d45f40f054eec1f6580af07df3ed4c
Instruction ID: f9047d7434dced4cf20933e84560d58d69618fbb45727c1a51f3fb53e9aaca21
Opcode Fuzzy Hash: fd654fbc9e612cb654ed9e4d8faceb9001d45f40f054eec1f6580af07df3ed4c
Instruction Fuzzy Hash: 1B814DB5E042099BDF18CF99DD81ABEBBB5FF88310F14812AE905B7340DB359911CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004FB0A0 Relevance: .8, Instructions: 763COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
Instruction ID: f66ee135833696fdc7097fc137d742b9d11648fb3e57faaf4428e0af157d3001
Opcode Fuzzy Hash: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
Instruction Fuzzy Hash: 653274B3F5161447DF1CCA6ECC922EDB2E36FD821871E813DE80AE3345EA79E9454684

Uniqueness

Uniqueness Score: -1.00%

Function 00510140 Relevance: .7, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f2036eef49e5e85395cc8371fabf856195ee32ae0729c8c85f023195ba78ab1
Instruction ID: 7734e3287553b3d74106f6f7eb9ccba05eed1c215cdc5eb9b880f13b62f88aab
Opcode Fuzzy Hash: 1f2036eef49e5e85395cc8371fabf856195ee32ae0729c8c85f023195ba78ab1
Instruction Fuzzy Hash: 65428D75A043418FE714CF28C480B5ABBE1BFC8314F149A6DE9999B395D7B1E8C5CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0042A040 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbfdc33d2fdc3bee5cddbea4ce36b5624ba5c86133e9e197b308071150bd34ce
Instruction ID: e176e8c39fa0001ffa0331148fc1a1e597aad8ea40cb8f55bb963474ee5d0d66
Opcode Fuzzy Hash: fbfdc33d2fdc3bee5cddbea4ce36b5624ba5c86133e9e197b308071150bd34ce
Instruction Fuzzy Hash: BEE1F372F1022A8FCB05CFA8D8816ADFBF1AF88324F5941AAD815B7340D774A955CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004FC0A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142b9e497edc779feb926e324d820a004adefa17f44103fd404662cc1c40eab9
Instruction ID: 38e074bbf3e805e58539ca8d739cae2271b6a1961dda6b795eee354daaa2981f
Opcode Fuzzy Hash: 142b9e497edc779feb926e324d820a004adefa17f44103fd404662cc1c40eab9
Instruction Fuzzy Hash: 2361DA316201A84FE748DF5EFCC0476B361E3AE301789461AEA81CB395C675F56AE7E0

Uniqueness

Uniqueness Score: -1.00%

Function 005040A0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1584348cf9e3f3be4a9b24cc4e2ffe07feb8b558a8eaef0232f41b95094aa3e0
Instruction ID: 7211d50b4de8a7ebd746b1f7ef274bdd41a532539b5b6ed0c87081a493a79e19
Opcode Fuzzy Hash: 1584348cf9e3f3be4a9b24cc4e2ffe07feb8b558a8eaef0232f41b95094aa3e0
Instruction Fuzzy Hash: 19312972B80708AEDB209E69CC40BCDBF96EF45211F04C559FD9C9B750C271E259C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 004220F3 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 379COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00422A7B
___std_exception_destroy.LIBVCRUNTIME ref: 00422A94
___std_exception_destroy.LIBVCRUNTIME ref: 00422B51
___std_exception_destroy.LIBVCRUNTIME ref: 00422B6A

Strings

, xrefs: 004225C6
number overflow parsing ', xrefs: 0042295E
array, xrefs: 0042254B

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: $array$number overflow parsing '
API String ID: 4194217158-1444002993
Opcode ID: 480f1ea474107f71b778f3c842a5369ced5b9b406927fb042976458005920f2e
Instruction ID: b9be30596a158e5ed89902264b7fe79a610ddcfe29da18a95ce0fa7f3111436e
Opcode Fuzzy Hash: 480f1ea474107f71b778f3c842a5369ced5b9b406927fb042976458005920f2e
Instruction Fuzzy Hash: 5EF11070D002599FCB14CFA0D984BEEFBB4BF15304F54829EE44977242DB78AA89CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00432056 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 303COMMON

Download Yara Rule

APIs

___TypeMatch.LIBVCRUNTIME ref: 00432283
_UnwindNestedFrames.LIBCMT ref: 004323D5
CallUnexpected.LIBVCRUNTIME ref: 004323F0

Strings

L;V, xrefs: 0043216C
csm, xrefs: 00432093
csm, xrefs: 00432100
csm, xrefs: 004321AC

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind
String ID: L;V$csm$csm$csm
API String ID: 3456342781-3339109018
Opcode ID: f219870799de8bf8d93d667d8b8260d42bea9e02fac3f36c4a5e93c416ed644d
Instruction ID: 1a3b2e3aada59ff5ba11aad393d6dbbfac41e5171332123353ed96db4a75ae81
Opcode Fuzzy Hash: f219870799de8bf8d93d667d8b8260d42bea9e02fac3f36c4a5e93c416ed644d
Instruction Fuzzy Hash: 81B19971800219EFCF18DFA5CA819AFBBB5FF08314F14605BE9106B252D7B8DA51CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00422032 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00422B51
___std_exception_destroy.LIBVCRUNTIME ref: 00422B6A

Strings

, xrefs: 004225C6
array, xrefs: 0042254B

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: $array
API String ID: 4194217158-2848110696
Opcode ID: 3d6bbb5eeb9172bfa257f394eb500065afff9989a7f434fa6634e6c51bf1637d
Instruction ID: 609c5a3700c6786cab836529116566ed5d02bc52a958d6c1bc70f00cba6690f6
Opcode Fuzzy Hash: 3d6bbb5eeb9172bfa257f394eb500065afff9989a7f434fa6634e6c51bf1637d
Instruction Fuzzy Hash: 7961B370E00259EFCB14DFA4D990BEEBBB4FF15304F50416ED406A7241EB78AA89CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00407080 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004071FE

Strings

0f@, xrefs: 004071E2
ange, xrefs: 004070AF
0f@, xrefs: 00407210

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@$ange
API String ID: 2659868963-373280750
Opcode ID: ffe6436ea23728eaf55144815bccbff6b30d1088563154c710925e0334a587d5
Instruction ID: 288f119f4ccb4c7cf0b8972ea0ca9e4329cc491e57a4aee3b53e0c7375ef9e73
Opcode Fuzzy Hash: ffe6436ea23728eaf55144815bccbff6b30d1088563154c710925e0334a587d5
Instruction Fuzzy Hash: 3E51F371D002449BDB18CFA8DC847ADBBB0FF85304F24836EE4157B391E7B8A9848B55

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0041417F
___std_exception_copy.LIBVCRUNTIME ref: 004141A6

Strings

0f@, xrefs: 00414184
0f@, xrefs: 004141B5

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@
API String ID: 2659868963-4245790314
Opcode ID: a0ec767d29c154d107e2924c90945eb70bd3bcc0216d37c8e4efd4af5cc58e06
Instruction ID: a7d6c344e60e7f18edcee1d7e68ac694af1bcf80748ebca3b88f48a52b3fdaf1
Opcode Fuzzy Hash: a0ec767d29c154d107e2924c90945eb70bd3bcc0216d37c8e4efd4af5cc58e06
Instruction Fuzzy Hash: 53F0FFB6910B16AB8751DFA6D440882FBFCFE55310750872BA51597A00F7B4F5588BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00490040 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00490044
GetCurrentProcessId.KERNEL32 ref: 0049004C
SetEvent.KERNEL32 ref: 00490069
WaitForSingleObject.KERNEL32(000000FF), ref: 00490077

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: Current$EventObjectProcessSingleThreadWait
String ID:
API String ID: 977356572-0
Opcode ID: 07ad26c9a8193a9c403b999b7260b6d74736513c4a61b8b242bc8500957e93da
Instruction ID: 68696a4330ff011d049e89e8b4814e5f18df6cd1e962ac77584aedc126b31ea8
Opcode Fuzzy Hash: 07ad26c9a8193a9c403b999b7260b6d74736513c4a61b8b242bc8500957e93da
Instruction Fuzzy Hash: CCE0467104A615EFCB049F68EC0C865BFA5FB297717408222FC09977B0DB708888EF80

Uniqueness

Uniqueness Score: -1.00%

Function 00406140 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

___std_fs_get_full_path_name@12.LIBCPMT ref: 004061F2

Strings

h<W, xrefs: 004061B7, 00406242
absolute, xrefs: 00406274

Memory Dump Source

Source File: 00000000.00000002.2410994426.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2410994426.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2410994426.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ygm2mXUReY.jbxd

Similarity

API ID: ___std_fs_get_full_path_name@12
String ID: absolute$h<W
API String ID: 319883303-1227054036
Opcode ID: fc19779bb5a5af7582c79339770b481127d2738d3652d52236bc829e3857b7da
Instruction ID: a39a9e8cd5e7c649dec9d62c81c2f08022a5113abdb27f993b439c29f203247c
Opcode Fuzzy Hash: fc19779bb5a5af7582c79339770b481127d2738d3652d52236bc829e3857b7da
Instruction Fuzzy Hash: C651AEB0E00315ABDB14DF58C9047AABBF4FF48314F10466EE815A7380D775A950CBE5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ygm2mXUReY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_11df57f9-a911-4a76-ad6c-3fa73011ab48\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_312dbc34-0135-4795-993d-44365049eb94\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_3d419301-bf8a-4dc3-ab87-97d54a9e0356\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_457182eb-5933-493a-bcc4-dd0068772e19\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_64aa4c50-a1b6-477f-81c5-7c1101021e37\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_782df4d4-a9ed-4ef0-9c2b-b94a67192a7b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_7ac4df01-ceba-4e94-89d2-844c94f59c45\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_9507a248-5cec-477c-965b-79a1daac08d5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1695d586fe6dcb3fc26aa419f17677af41dbbd72_05789ee0_b4010589-7351-456c-928a-338198f9d087\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ygm2mXUReY.exe_65396d3389e0d0bfd23059c0a7ad776d4579bbf9_66eab1d0_231ce3d8-5135-43dc-a832-9839be86e7db\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ygm2mXUReY.exe_65396d3389e0d0bfd23059c0a7ad776d4579bbf9_66eab1d0_2bf57861-c4ef-4b8b-97e9-ae95bb3c92d5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ygm2mXUReY.exe_65396d3389e0d0bfd23059c0a7ad776d4579bbf9_66eab1d0_31ad85ba-b8f8-437e-acc5-4874b249f007\Report.wer

Windows Analysis Report
ygm2mXUReY.exe

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre