Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1431817
MD5:	6795efba98699a0cae3c4f729b83ace9
SHA1:	a46482db507cf67307880919b85dc2187d2a2512
SHA256:	026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd
Tags:	exe
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5688 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6795EFBA98699A0CAE3C4F729B83ACE9)

schtasks.exe (PID: 576 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2704 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 828 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 1948 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 3160 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 6795EFBA98699A0CAE3C4F729B83ACE9)

WerFault.exe (PID: 1568 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1152 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 1896 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 6795EFBA98699A0CAE3C4F729B83ACE9)

RageMP131.exe (PID: 6984 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 6795EFBA98699A0CAE3C4F729B83ACE9)

RageMP131.exe (PID: 4204 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 6795EFBA98699A0CAE3C4F729B83ACE9)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\HCwgibNvhQ3gDx_DWG1aNau.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1YMX7UxRgh318S1TWXmjgUx.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2326694552.0000000005DC4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000002.2333459442.00000000059B0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: file.exe PID: 5688	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: file.exe PID: 5688	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 3160	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 3160	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 1896	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 6984	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 5688, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/25/24-20:36:02.824956
SID:	2046266
Source Port:	58709
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/25/24-20:36:09.524020
SID:	2046269
Source Port:	49708
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/25/24-20:36:02.835774
SID:	2046266
Source Port:	58709
Destination Port:	49709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/25/24-20:36:20.853335
SID:	2046266
Source Port:	58709
Destination Port:	49724
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/25/24-20:36:03.375523
SID:	2046267
Source Port:	58709
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/25/24-20:36:03.390482
SID:	2046267
Source Port:	58709
Destination Port:	49709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/25/24-20:36:00.328630
SID:	2049060
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/25/24-20:36:23.977267
SID:	2046269
Source Port:	49724
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/25/24-20:36:00.782969
SID:	2046267
Source Port:	58709
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/25/24-20:36:00.533633
SID:	2046266
Source Port:	58709
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/25/24-20:36:14.063364
SID:	2046269
Source Port:	49714
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 147.45.47.93

Timestamp:	04/25/24-20:36:07.671962
SID:	2046269
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.5

Timestamp:	04/25/24-20:36:10.545583
SID:	2046266
Source Port:	58709
Destination Port:	49714
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://193.233.132.167/cost/lenin.exe	URL Reputation: Label: malware
Source: http://193.233.132.167/cost/go.exe	Avira URL Cloud: Label: malware
Source: http://193.233.132.167/cost/go.exe(i	Avira URL Cloud: Label: malware
Source: http://147.45.47.102:57893/hera/amadka.exe	Avira URL Cloud: Label: malware
Source: http://193.233.132.167/cost/go.exedka.exe	Avira URL Cloud: Label: malware
Source: http://193.233.132.167/cost/lenin.exeegent	Avira URL Cloud: Label: malware
Source: http://193.233.132.167/cost/go.exeerver	Avira URL Cloud: Label: malware
Source: http://193.233.132.167/cost/lenin.exeerH_	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: http://193.233.132.167/cost/go.exe	Virustotal: Detection: 24%	Perma Link
Source: http://147.45.47.102:57893/hera/amadka.exe	Virustotal: Detection: 18%	Perma Link
Source: http://147.45.47.102:57893/hera/amadka.exeop	Virustotal: Detection: 18%	Perma Link
Source: http://193.233.132.167/cost/go.exedka.exe	Virustotal: Detection: 25%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Virustotal: Detection: 39%	Perma Link
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Virustotal: Detection: 39%	Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00863EB0 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		0_2_00863EB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00303EB0 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		6_2_00303EB0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49738 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_0087D2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00831A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	0_2_00831A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008633B0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_008633B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00883B20 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_00883B20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D1F8C FindClose,FindFirstFileExW,GetLastError,	0_2_007D1F8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D2012 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_007D2012
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008313F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_008313F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0031D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	6_2_0031D2B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_003033B0 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	6_2_003033B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002D1A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	6_2_002D1A60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00323B20 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	6_2_00323B20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00271F8C FindClose,FindFirstFileExW,GetLastError,	6_2_00271F8C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00272012 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	6_2_00272012
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002D13F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	6_2_002D13F0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.5:49705 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49705
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.5:49705
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49708
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.5:49708
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.5:49709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49705 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49708 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49714
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49714 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49724
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49724 -> 147.45.47.93:58709

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 147.45.47.93:58709

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 147.45.47.93 147.45.47.93
Source: Joe Sandbox View	IP Address: 104.26.5.15 104.26.5.15

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/185.152.66.230 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=185.152.66.230 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/185.152.66.230 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/185.152.66.230 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=185.152.66.230 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=185.152.66.230 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/185.152.66.230 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=185.152.66.230 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/185.152.66.230 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=185.152.66.230 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00865940 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,FreeAddrInfoW,WSACleanup,FreeAddrInfoW,

0_2_00865940

Source: global traffic	HTTP traffic detected: GET /widget/demo/185.152.66.230 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=185.152.66.230 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/185.152.66.230 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/185.152.66.230 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=185.152.66.230 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=185.152.66.230 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/185.152.66.230 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=185.152.66.230 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/185.152.66.230 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=185.152.66.230 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com

Source: file.exe, 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe&i
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe42359
Source: file.exe, 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeop
Source: file.exe, 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe
Source: MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe(i
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exedka.exe
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exeerver
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe
Source: MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exeegent
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exeerH_
Source: Amcache.hve.11.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000003.2033168714.0000000002E70000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.2331180596.000000000039B000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2059493244.0000000001020000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2059966123.0000000000FA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2129853471.000000000039B000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000008.00000003.2138507545.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2430993688.0000000000F5B000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000003.2228346695.00000000016E0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2531991205.0000000000F5B000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RageMP131.exe, 00000010.00000003.2455967104.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000003.2455967104.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019E3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000003.2455967104.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=185.152.66.230
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=185.152.66.230Xl
Source: MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=185.152.66.230i
Source: file.exe, 00000000.00000002.2325278165.0000000001400000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=185.152.66.230
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=185.152.66.230.datapacket.com
Source: RageMP131.exe, 00000010.00000002.2533471546.00000000019E3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000003.2455967104.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=185.152.66.230P
Source: file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2431987171.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.000000000198F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019E3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019CC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000003.2455967104.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001109000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/1
Source: RageMP131.exe, 00000010.00000002.2533471546.00000000019C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/6K
Source: file.exe, 00000000.00000002.2325278165.00000000013EF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.0000000001109000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: RageMP131.exe, 00000008.00000002.2431987171.00000000018D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/O
Source: file.exe, 00000000.00000003.2033168714.0000000002E70000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.2331180596.000000000039B000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2059493244.0000000001020000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2059966123.0000000000FA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2129853471.000000000039B000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000008.00000003.2138507545.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2430993688.0000000000F5B000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000003.2228346695.00000000016E0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2531991205.0000000000F5B000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: MPGPH131.exe, 00000006.00000002.2332544604.00000000010D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/jM
Source: RageMP131.exe, 00000008.00000002.2431987171.000000000190F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/m
Source: RageMP131.exe, 00000010.00000002.2533471546.000000000198F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/s
Source: RageMP131.exe, 00000008.00000002.2431987171.00000000018EC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2431987171.0000000001915000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019CC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/185.152.66.230
Source: RageMP131.exe, 00000010.00000002.2533471546.00000000019AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/185.152.66.230q
Source: file.exe, 00000000.00000002.2325278165.00000000013E6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.0000000001117000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/185.152.66.230
Source: RageMP131.exe, 00000008.00000002.2431987171.0000000001915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/185.152.66.230Qd
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2326694552.0000000005DC4000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.000000000109D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2333459442.00000000059B0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.0000000001087000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2431987171.000000000189E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.0000000001957000.00000004.00000020.00020000.00000000.sdmp, HCwgibNvhQ3gDx_DWG1aNau.zip.0.dr, 1YMX7UxRgh318S1TWXmjgUx.zip.6.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: file.exe, 00000000.00000002.2325278165.000000000136E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT.tPVx
Source: RageMP131.exe, 00000010.00000002.2533471546.0000000001957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT3
Source: RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro
Source: RageMP131.exe, 00000010.00000002.2533471546.00000000019E3000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr, passwords.txt.6.dr	String found in binary or memory: https://t.me/risepro_bot
Source: MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot6.230
Source: file.exe, 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot7
Source: RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: RageMP131.exe, 00000010.00000002.2533471546.00000000019E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botist
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlatere_(
Source: RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botsA
Source: file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/-_p
Source: file.exe, 00000000.00000003.2105638601.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115039621.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2114472164.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122244297.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2129153195.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108669470.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115593739.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2116658566.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2114154245.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2104422097.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2107373820.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2105396441.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108284720.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2117337036.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2110479328.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103676294.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106893933.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2117645844.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326694552.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2118084133.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2333535211.00000000059F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/a
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2105638601.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115039621.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2114472164.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122244297.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2129153195.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108669470.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115593739.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2116658566.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2114154245.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2104422097.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2107373820.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2105396441.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108284720.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2117337036.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2110479328.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103676294.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106893933.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2117645844.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326694552.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2118084133.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2333535211.00000000059F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/e
Source: file.exe, 00000000.00000003.2105638601.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115039621.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2114472164.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122244297.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2129153195.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108669470.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115593739.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2116658566.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2114154245.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2104422097.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2107373820.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2105396441.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108284720.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2117337036.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2110479328.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103676294.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106893933.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2117645844.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326694552.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2118084133.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2333535211.00000000059F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/irefox

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.5:49738 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008833A0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,73B574A0,DeleteObject,DeleteObject,ReleaseDC,

0_2_008833A0

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00898080	0_2_00898080
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008DC8D0	0_2_008DC8D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E001D	0_2_007E001D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007AB8E0	0_2_007AB8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008749B0	0_2_008749B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008361D0	0_2_008361D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00838A80	0_2_00838A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087D2B0	0_2_0087D2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00831A60	0_2_00831A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087C3E0	0_2_0087C3E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083CBF0	0_2_0083CBF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F8BA0	0_2_007F8BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00847D20	0_2_00847D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083AEC0	0_2_0083AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00833ED0	0_2_00833ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087B7E0	0_2_0087B7E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0081F730	0_2_0081F730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082DF60	0_2_0082DF60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E40A0	0_2_008E40A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D20C0	0_2_008D20C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007DC950	0_2_007DC950
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007DA918	0_2_007DA918
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00822100	0_2_00822100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00841130	0_2_00841130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D7190	0_2_007D7190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E3160	0_2_008E3160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E4AE0	0_2_008E4AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00884B90	0_2_00884B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E035F	0_2_007E035F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00830BA0	0_2_00830BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00890350	0_2_00890350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CF570	0_2_007CF570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F25FE	0_2_007F25FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F8E20	0_2_007F8E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00841E40	0_2_00841E40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088BFC0	0_2_0088BFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088CFC0	0_2_0088CFC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0028001D	6_2_0028001D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00338080	6_2_00338080
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002D61D0	6_2_002D61D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0031D2B0	6_2_0031D2B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0031C3E0	6_2_0031C3E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002BF730	6_2_002BF730
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0031B7E0	6_2_0031B7E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0024B8E0	6_2_0024B8E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0037C8D0	6_2_0037C8D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_003149B0	6_2_003149B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002D1A60	6_2_002D1A60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002D8A80	6_2_002D8A80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002DCBF0	6_2_002DCBF0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002E7D20	6_2_002E7D20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002DAEC0	6_2_002DAEC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002D3ED0	6_2_002D3ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002CDF60	6_2_002CDF60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_003840A0	6_2_003840A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_003720C0	6_2_003720C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002E1130	6_2_002E1130
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002C2100	6_2_002C2100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00383160	6_2_00383160
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00277190	6_2_00277190
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0037F280	6_2_0037F280
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00330350	6_2_00330350
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0028035F	6_2_0028035F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0026F570	6_2_0026F570
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002947AD	6_2_002947AD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0027A918	6_2_0027A918
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0027C950	6_2_0027C950
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0028DA74	6_2_0028DA74
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00385A40	6_2_00385A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00384AE0	6_2_00384AE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00298BA0	6_2_00298BA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002D0BA0	6_2_002D0BA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00324B90	6_2_00324B90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0041FDB6	6_2_0041FDB6
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00298E20	6_2_00298E20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002E1E40	6_2_002E1E40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0032CFC0	6_2_0032CFC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0032BFC0	6_2_0032BFC0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 007BACE0 appears 86 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0025ACE0 appears 86 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 1948

Source: RageMP131.exe.0.dr	Static PE information: Number of sections : 12 > 10
Source: MPGPH131.exe.0.dr	Static PE information: Number of sections : 12 > 10
Source: file.exe	Static PE information: Number of sections : 12 > 10

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000000.2029591798.000000000094A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs file.exe
Source: file.exe, 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.999460876105108
Source: file.exe	Static PE information: Section: ZLIB complexity 0.9960345643939394
Source: file.exe	Static PE information: Section: ZLIB complexity 1.0023871527777777
Source: file.exe	Static PE information: Section: ZLIB complexity 0.9898745888157895
Source: file.exe	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.999460876105108
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9960345643939394
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0023871527777777
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9898745888157895
Source: RageMP131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.999460876105108
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9960345643939394
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0023871527777777
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9898745888157895
Source: MPGPH131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@13/58@2/3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0087D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

0_2_0087D2B0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3160
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2212:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5688
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1788:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2033168714.0000000002E70000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.2331180596.000000000039B000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2059493244.0000000001020000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2059966123.0000000000FA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2129853471.000000000039B000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000008.00000003.2138507545.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2430993688.0000000000F5B000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000003.2228346695.00000000016E0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2531991205.0000000000F5B000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000003.2033168714.0000000002E70000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.2331180596.000000000039B000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2059493244.0000000001020000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2059966123.0000000000FA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2129853471.000000000039B000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000008.00000003.2138507545.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2430993688.0000000000F5B000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000003.2228346695.00000000016E0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2531991205.0000000000F5B000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000003.2104608499.0000000005DF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2114472164.0000000005DE0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2142090491.00000000059FB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2148821408.0000000005A05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2140859397.00000000059FB000.00000004.00000020.00020000.00000000.sdmp, OhQNgUJ0X5NgLogin Data.0.dr, 7PzLqHtz21igLogin Data For Account.6.dr, zvXv7gzjmXYkLogin Data For Account.0.dr, S0Pov5vdwAn3Login Data.6.dr, sdYAsTf3586cLogin Data.0.dr, NMxkTlMy11FaLogin Data.6.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 1948
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1152
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: file.exe

Static file information: File size 2270736 > 1048576

Source: file.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x188600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0086C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_0086C630

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .vm_sec
Source: file.exe	Static PE information: section name: .themida
Source: file.exe	Static PE information: section name: .boot
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .vm_sec
Source: RageMP131.exe.0.dr	Static PE information: section name: .themida
Source: RageMP131.exe.0.dr	Static PE information: section name: .boot
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .vm_sec
Source: MPGPH131.exe.0.dr	Static PE information: section name: .themida
Source: MPGPH131.exe.0.dr	Static PE information: section name: .boot

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B39D2D push esi; mov dword ptr [esp], 0047292Eh	0_2_00C12F43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B39D2D push ebp; mov dword ptr [esp], esi	0_2_00C12F57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B39D2D push 21151430h; mov dword ptr [esp], ecx	0_2_00C12F6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B39D2D push 224624E2h; mov dword ptr [esp], edi	0_2_00C12FF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D3F49 push ecx; ret	0_2_007D3F5C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005D9D2D push esi; mov dword ptr [esp], 0047292Eh	6_2_006B2F43
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005D9D2D push ebp; mov dword ptr [esp], esi	6_2_006B2F57
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005D9D2D push 21151430h; mov dword ptr [esp], ecx	6_2_006B2F6F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005D9D2D push 224624E2h; mov dword ptr [esp], edi	6_2_006B2FF5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00273F49 push ecx; ret	6_2_00273F5C

Source: file.exe	Static PE information: section name: entropy: 7.999486852289058
Source: file.exe	Static PE information: section name: .boot entropy: 7.949192596228493
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.999486852289058
Source: RageMP131.exe.0.dr	Static PE information: section name: .boot entropy: 7.949192596228493
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.999486852289058
Source: MPGPH131.exe.0.dr	Static PE information: section name: .boot entropy: 7.949192596228493

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Stalling execution: Execution stalls by calling Sleep

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-50128
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-50222

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6624	Thread sleep count: 163 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 4524	Thread sleep count: 85 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 4524	Thread sleep count: 149 > 30

Source: C:\Users\user\Desktop\file.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_0087D2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00831A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	0_2_00831A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008633B0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_008633B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00883B20 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_00883B20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D1F8C FindClose,FindFirstFileExW,GetLastError,	0_2_007D1F8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D2012 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_007D2012
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008313F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_008313F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0031D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	6_2_0031D2B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_003033B0 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	6_2_003033B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002D1A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	6_2_002D1A60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00323B20 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	6_2_00323B20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00271F8C FindClose,FindFirstFileExW,GetLastError,	6_2_00271F8C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00272012 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	6_2_00272012
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002D13F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	6_2_002D13F0

Source: C:\Users\user\Desktop\file.exe

0_2_0087D2B0

Source: MPGPH131.exe, 00000006.00000002.2332544604.000000000116E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_C7C08627:
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: formVMware20,11696428655
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ccount.microsoft.com/profileVMware20,11696428655u
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT service, encrypted_token FROM token_servicerr global passwords blocklistVMware20,11696428655
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: MPGPH131.exe, 00000006.00000003.2149215743.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r global passwords blocklistVMware20,11696428655
Source: MPGPH131.exe, 00000006.00000003.2149215743.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696428655
Source: MPGPH131.exe, 00000007.00000002.2132463206.0000000001080000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.11.dr	Binary or memory string: vmci.sys
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Amcache.hve.11.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: MPGPH131.exe, 00000006.00000003.2149215743.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT name, value FROM autofillmain'.sqlite_masterr global passwords blocklistVMware20,11696428655
Source: Amcache.hve.11.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.11.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RageMP131.exe, 00000008.00000002.2431987171.00000000018EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&"_
Source: RageMP131.exe, 00000008.00000003.2153200187.0000000001903000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}^
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual USB Mouse
Source: RageMP131.exe, 00000010.00000002.2533471546.00000000019B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: RageMP131.exe, 00000010.00000002.2533471546.00000000019B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000006.00000003.2149215743.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,116
Source: Amcache.hve.11.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MPGPH131.exe, 00000006.00000002.2332544604.000000000116E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_C7C08627
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Amcache.hve.11.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rootpagecomVMware20,11696428655o
Source: Amcache.hve.11.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin`
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.11.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pageformVMware20,11696428655
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: MPGPH131.exe, 00000006.00000003.2149215743.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428H
Source: Amcache.hve.11.dr	Binary or memory string: VMware
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.11.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000000.00000002.2325278165.0000000001400000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2325278165.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010D4000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2431987171.00000000018EC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019E3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000003.2455967104.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MPGPH131.exe, 00000006.00000003.2153261936.000000000117C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}lfons\AppData\Local\NVIDIA Corporation\NVIDIA GeForce Experience\*
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RageMP131.exe, 00000010.00000003.2256184432.00000000019B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000006.00000003.2149215743.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eVMware20,11696428655
Source: Amcache.hve.11.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,1169642865
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,116968
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1
Source: file.exe, 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\Profiles\v6zchhhv.default-release\signons.sqlite.nl,n.[
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.11.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ra Change Transaction PasswordVMware20,11696428655
Source: Amcache.hve.11.dr	Binary or memory string: VMware VMCI Bus Device
Source: MPGPH131.exe, 00000006.00000003.2149342197.0000000005A18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .bankofamerica.comVMware20,11696
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o.inVMware20,11696428655~
Source: file.exe, 00000000.00000002.2325845259.000000000145A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}W?
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.11.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RageMP131.exe, 00000010.00000002.2533471546.0000000001950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.11.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARtive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.11.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: comVMware20,11696428655o
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.11.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: XQcivVrU5A5HWeb Data.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.11.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}y,h.uy,i.uy,j.uy,k.uy,l.uy,m.uy,n.uy,o.uy,p.uy,q.uy,r.uy,s.uy,t.uy,u.uy,v.uy,w.uy,x.uy,y.uy,z.uy,a
Source: file.exe, 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}gramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows8ZAAAA``/
Source: Amcache.hve.11.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: MPGPH131.exe, 00000006.00000003.2149215743.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,1169642865@
Source: file.exe, 00000000.00000002.2325278165.0000000001400000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: RageMP131.exe, 00000010.00000002.2533471546.00000000019E3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000003.2455967104.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>
Source: MPGPH131.exe, 00000006.00000003.2151353310.0000000005A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,116`
Source: RageMP131.exe, 00000010.00000002.2533471546.000000000199F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007D8A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_007D8A54

Source: C:\Users\user\Desktop\file.exe

0_2_0086C630

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00864130 mov eax, dword ptr fs:[00000030h]	0_2_00864130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00831A60 mov eax, dword ptr fs:[00000030h]	0_2_00831A60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00304130 mov eax, dword ptr fs:[00000030h]	6_2_00304130
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_002D1A60 mov eax, dword ptr fs:[00000030h]	6_2_002D1A60

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00886E20 GetLastError,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,HeapFree,RtlAllocateHeap,HeapFree,

0_2_00886E20

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D8A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_007D8A54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D450D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_007D450D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0027450D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0027450D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00278A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00278A54

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		0_2_0086C630
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0030C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		6_2_0030C630

Source: C:\Users\user\Desktop\file.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_0087D2B0
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_007F31B8
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_007EB1A3
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_007F32E1
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_007F2B48
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_007F33E7
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_007F34BD
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_007F2D4D
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_007F2DF4
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_007F2E3F
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_007F2EDA
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_007F2F65
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_007EB726
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	6_2_0031D2B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_0028B1A3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_002931B8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_002932E1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_002933E7
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_002934BD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_0028B726
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_00292B48
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_00292D4D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_00292DF4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_00292E3F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_00292EDA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_00292F65

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

0_2_0087D2B0

Source: C:\Users\user\Desktop\file.exe

0_2_0087D2B0

Source: C:\Users\user\Desktop\file.exe

0_2_0087D2B0

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.11.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.2326694552.0000000005DC4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2333459442.00000000059B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 3160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 1896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\HCwgibNvhQ3gDx_DWG1aNau.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1YMX7UxRgh318S1TWXmjgUx.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2161978474.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\walletsni
Source: file.exe, 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: file.exe, 00000000.00000003.2161978474.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxxs
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: file.exe, 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: file.exe, 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: file.exe, 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: file.exe, 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000002.2325278165.0000000001400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: file.exe, 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live$

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 3160, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.2326694552.0000000005DC4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2333459442.00000000059B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 3160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 1896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\HCwgibNvhQ3gDx_DWG1aNau.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1YMX7UxRgh318S1TWXmjgUx.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	13 Virtualization/Sandbox Evasion	Cached Domain Credentials	351 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	13 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	39%	Virustotal	Browse
C:\ProgramData\MPGPH131\MPGPH131.exe	32%	ReversingLabs
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	32%	ReversingLabs
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	39%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://193.233.132.167/cost/lenin.exe	100%	URL Reputation	malware
http://193.233.132.167/cost/go.exe	100%	Avira URL Cloud	malware
http://193.233.132.167/cost/go.exe(i	100%	Avira URL Cloud	malware
http://147.45.47.102:57893/hera/amadka.exe42359	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe&i	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe	100%	Avira URL Cloud	malware
http://193.233.132.167/cost/go.exe	25%	Virustotal		Browse
http://147.45.47.102:57893/hera/amadka.exe	18%	Virustotal		Browse
http://193.233.132.167/cost/go.exedka.exe	100%	Avira URL Cloud	malware
http://147.45.47.102:57893/hera/amadka.exeop	0%	Avira URL Cloud	safe
http://193.233.132.167/cost/lenin.exeegent	100%	Avira URL Cloud	malware
http://193.233.132.167/cost/go.exeerver	100%	Avira URL Cloud	malware
http://193.233.132.167/cost/lenin.exeerH_	100%	Avira URL Cloud	malware
http://147.45.47.102:57893/hera/amadka.exeop	18%	Virustotal		Browse
http://193.233.132.167/cost/go.exedka.exe	26%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		high
db-ip.com	104.26.5.15	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/185.152.66.230	false		high
https://db-ip.com/demo/home.php?s=185.152.66.230	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	false		high
https://db-ip.com:443/demo/home.php?s=185.152.66.230P	RageMP131.exe, 00000010.00000002.2533471546.00000000019E3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000003.2455967104.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	false		high
http://147.45.47.102:57893/hera/amadka.exe	file.exe, 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://147.45.47.102:57893/hera/amadka.exe42359	MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/6K	RageMP131.exe, 00000010.00000002.2533471546.00000000019C1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/	RageMP131.exe, 00000010.00000003.2455967104.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe&i	MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	false		high
http://193.233.132.167/cost/go.exe(i	MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://t.me/risepro	RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exe	file.exe, 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	true	25%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://db-ip.com:443/demo/home.php?s=185.152.66.230	file.exe, 00000000.00000002.2325278165.0000000001400000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	false		high
https://ipinfo.io/s	RageMP131.exe, 00000010.00000002.2533471546.000000000198F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io:443/widget/demo/185.152.66.230Qd	RageMP131.exe, 00000008.00000002.2431987171.0000000001915000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botisepro_bot	RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019E3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exeop	file.exe, 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/risepro_bot7	file.exe, 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/lenin.exe	MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://ipinfo.io/m	RageMP131.exe, 00000008.00000002.2431987171.000000000190F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/185.152.66.230q	RageMP131.exe, 00000010.00000002.2533471546.00000000019AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORT.tPVx	file.exe, 00000000.00000002.2325278165.000000000136E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/lenin.exeegent	MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://db-ip.com:443/demo/home.php?s=185.152.66.230.datapacket.com	MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot6.230	MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORT3	RageMP131.exe, 00000010.00000002.2533471546.0000000001957000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	false		high
https://ipinfo.io/O	RageMP131.exe, 00000008.00000002.2431987171.00000000018D3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	file.exe, 00000000.00000003.2033168714.0000000002E70000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.2331180596.000000000039B000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2059493244.0000000001020000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2059966123.0000000000FA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2129853471.000000000039B000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000008.00000003.2138507545.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2430993688.0000000000F5B000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000003.2228346695.00000000016E0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2531991205.0000000000F5B000.00000040.00000001.01000000.00000006.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	false		high
http://193.233.132.167/cost/go.exedka.exe	MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	false	26%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://193.233.132.167/cost/go.exeerver	MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://upx.sf.net	Amcache.hve.11.dr	false		high
https://t.me/RiseProSUPPORT	file.exe, 00000000.00000002.2326694552.0000000005DC4000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.000000000109D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2333459442.00000000059B0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.0000000001087000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2431987171.000000000189E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.0000000001957000.00000004.00000020.00020000.00000000.sdmp, HCwgibNvhQ3gDx_DWG1aNau.zip.0.dr, 1YMX7UxRgh318S1TWXmjgUx.zip.6.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	false		high
https://ipinfo.io/Mozilla/5.0	file.exe, 00000000.00000002.2325278165.00000000013EF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.0000000001109000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.7.dr	false		high
https://t.me/risepro_botist	RageMP131.exe, 00000010.00000002.2533471546.00000000019E3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	false		high
https://db-ip.com/demo/home.php?s=185.152.66.230i	MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot	RageMP131.exe, 00000010.00000002.2533471546.00000000019E3000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr, passwords.txt.6.dr	false		high
https://ipinfo.io/	RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2431987171.00000000018D3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.000000000198F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019E3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019CC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000003.2455967104.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/1	MPGPH131.exe, 00000006.00000002.2332544604.0000000001109000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.maxmind.com/en/locate-my-ip-address	file.exe, MPGPH131.exe	false		high
https://db-ip.com/demo/home.php?s=185.152.66.230Xl	MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io:443/widget/demo/185.152.66.230	file.exe, 00000000.00000002.2325278165.00000000013E6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2332544604.0000000001117000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2132463206.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2533471546.00000000019CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	D87fZN3R3jFeplaces.sqlite.7.dr	false		high
https://t.me/risepro_botsA	RageMP131.exe, 00000008.00000002.2431987171.000000000191E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.winimage.com/zLibDll	file.exe, 00000000.00000003.2033168714.0000000002E70000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000006.00000002.2331180596.000000000039B000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2059493244.0000000001020000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2059966123.0000000000FA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2129853471.000000000039B000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000008.00000003.2138507545.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2430993688.0000000000F5B000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000003.2228346695.00000000016E0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2531991205.0000000000F5B000.00000040.00000001.01000000.00000006.sdmp	false		high
https://t.me/risepro_botlatere_(	MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/lenin.exeerH_	MPGPH131.exe, 00000006.00000002.2332544604.0000000001123000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.7.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2111757556.0000000005E09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106406140.0000000005E05000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2141943768.0000000005A22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2143543361.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, FnKWlcBrreY1Web Data.6.dr, zeSJ9T1kwjwWWeb Data.6.dr, NwbTBYLMclw6Web Data.0.dr, Y9g_BlDmKPtZWeb Data.0.dr, tQzi7j4yFcLSWeb Data.6.dr, MQHnFYhPldB3Web Data.0.dr	false		high
https://ipinfo.io/jM	MPGPH131.exe, 00000006.00000002.2332544604.00000000010D1000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
104.26.5.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431817
Start date and time:	2024-04-25 20:35:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@13/58@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 67% Number of executed functions: 48 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:35:58	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
20:35:59	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
20:35:59	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
20:36:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
20:36:26	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
147.45.47.93	file.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse
	ygm2mXUReY.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	UeW2b6mU6Z.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
104.26.5.15	SecuriteInfo.com.Win64.Evo-gen.17494.7440.exe	Get hash	malicious	Unknown	Browse	api.db-ip.com/v2/free/127.0.0.1
	Nemty.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/84.17.52.2/countryName
	227.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/102.129.143.40/countryName

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	file.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, zgRAT	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	http://crunchersflowdigital.com	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	TeaiGames.exe	Get hash	malicious	NovaSentinel	Browse	34.117.186.192
	ShadowFury.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	ShadowFury.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SOLkM5sa4R.exe	Get hash	malicious	Phemedrone Stealer	Browse	34.117.186.192
	xOiio3LmAO.exe	Get hash	malicious	Phemedrone Stealer	Browse	34.117.186.192
db-ip.com	file.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, zgRAT	Browse	172.67.75.166
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	ygm2mXUReY.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15
	2q45IEa3Ee.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.4.15
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, zgRAT	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	0ar3q66pGv.elf	Get hash	malicious	Mirai	Browse	34.116.69.95
	http://94.156.79.129/x86_64	Get hash	malicious	Unknown	Browse	34.117.121.53
	http://94.156.79.129/i686	Get hash	malicious	Unknown	Browse	34.117.121.53
	http://crunchersflowdigital.com	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	https://i.imgur.com/EoTj4iI.png	Get hash	malicious	Unknown	Browse	34.117.239.71
	https://i.imgur.com/VlAllek.png	Get hash	malicious	Unknown	Browse	34.117.239.71
	https://tibusiness.cl/css/causarol.rar	Get hash	malicious	Unknown	Browse	34.117.188.166
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	uqGHhft2DO.elf	Get hash	malicious	Mirai	Browse	147.45.234.222
	file.exe	Get hash	malicious	RedLine	Browse	193.233.132.169
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	957C4XK6Lt.exe	Get hash	malicious	Phorpiex	Browse	193.233.132.177
	file.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.47
	file.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.47
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	193.233.132.234
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	193.233.132.234
CLOUDFLARENETUS	https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://clc.li/bsLRU	Get hash	malicious	HTMLPhisher	Browse	104.21.22.140
	https://sigtn.com////////utils/emt.cfm?client_id=9195153&campaign_id=73466&link=neoparts%E3%80%82com.br./dayo/fks6/TWFncm8uWXVkZWdvLkphdmllckBkZW1lLWdyb3VwLmNvbQ==$	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, zgRAT	Browse	172.67.75.166
	ProconGO1121082800.LnK.lnk	Get hash	malicious	Unknown	Browse	104.21.29.223
	o3KyzpE7F4.ps1	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	http://www.mh3solaroh.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.246.203
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	172.67.69.226
	https://www.jottacloud.com/s/3542495a6cd3d7a4aafad5878d671fdee68	Get hash	malicious	Unknown	Browse	162.159.152.4
	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse	172.67.223.170

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, zgRAT	Browse	104.26.5.15 34.117.186.192
	SecuriteInfo.com.Win32.Evo-gen.19638.13648.exe	Get hash	malicious	DBatLoader	Browse	104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	Iu4csQ2rwX.msi	Get hash	malicious	AsyncRAT	Browse	104.26.5.15 34.117.186.192
	o7b91j8vnJ.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	SHEOrder-10524.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15 34.117.186.192
	https://56hytuti5.weebly.com/	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2270736
Entropy (8bit):	7.922698187069996
Encrypted:	false
SSDEEP:	49152:Pwr0j3Y/qI2SgJeK3pJ3uwkeUB+C+26jAaa7V03:PW0j3YSI2SgJeKj3tjUcC+26jAaMa
MD5:	6795EFBA98699A0CAE3C4F729B83ACE9
SHA1:	A46482DB507CF67307880919B85DC2187D2A2512
SHA-256:	026387AA4411DAC1107E403FB44FA90C5A34EC5AB0068AF13E3F8F9F0B0F46CD
SHA-512:	12D49B08FEC9DFC8EFCDDD9CFC7BDD3930EBC128F21667DA11FC5AB1B80BA5F153608460275CF4F71695ED9B8B91BDF35261A099314B7EA10B39F000EDA1A101
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 39%, Browse Antivirus: ReversingLabs, Detection: 32%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L...^.%f...............'............X.P...........@...........................h......#...@.......................................... ........................h.................................................................@................... ............................ ..` Z{..........................@..@ 0I... ......................@... .....p......................@..@ ..... ...L..................@..B.vm_sec..@.......@...$..............@....idata...............d..............@....tls.................h...................rsrc........ .......j..............@..@.themida. 5.......... ..............`....boot.........P...... ..............`..`.reloc........h.......".

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_c7733ed6211f554fcfc5ee43638ebe35de626d7b_d1a40e08_31f9afae-1cd9-4f56-a64f-1215315a588c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0531971279628916
Encrypted:	false
SSDEEP:	192:xxxBlm7zT8DPC07ErhN6E6jjyZrofxjPzuiFhZ24IO826tB:xXDOTePJ7ErhAjLPzuiFhY4IO8pB
MD5:	122F940DF5DB7090D756D1880519B3CF
SHA1:	BF8DDE2AC2EAB5D61A22BC4B218403C3B01E3092
SHA-256:	6E6F865CC3F518E1ED6E36400FE28DF1DF6C2D6394BE83D603AF9FC327E99D14
SHA-512:	817917F056E1CA76528EB89C5870730DFD068CB188115620B0E9111768E679B7B49B7B6D4B626D21FBCD1AA188931A3FC9AA10A1CF01136407207D69F22F11EB
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.5.4.3.7.7.4.5.0.1.5.4.7.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.5.4.3.7.7.4.9.3.9.0.9.0.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.f.9.a.f.a.e.-.1.c.d.9.-.4.f.5.6.-.a.6.4.f.-.1.2.1.5.3.1.5.a.5.8.8.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.b.e.2.d.a.1.2.-.b.9.8.d.-.4.a.0.2.-.9.e.2.3.-.5.5.a.e.7.0.3.e.1.0.5.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.r.o.s.s.D.e.v.i.c.e.S.e.t.t.i.n.g.s.H.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.5.8.-.0.0.0.1.-.0.0.1.4.-.f.c.c.9.-.e.3.6.a.3.f.9.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.6.7.a.b.c.f.8.d.6.c.2.5.2.9.7.e.d.9.7.2.3.e.f.1.6.c.3.8.f.3.6.0.0.0.0.0.9.1.0.!.0.0.0.0.a.4.6.4.8.2.d.b.5.0.7.c.f.6.7.3.0.7.8.8.0.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_58fad3732ffecccafd3e19178e69f9a63423f5_394a0634_de233a83-76a7-4005-9f01-53431517d840\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0477692421157836
Encrypted:	false
SSDEEP:	192:DP3BC+ivsPXPS0LnaEE3jyZrosLZuzuiFhZ24IO82B:7RCTsvPZLnaXjyuzuiFhY4IO8W
MD5:	50B96B53F1205B969FFF94B8C85EBB3A
SHA1:	C9DED5B4976FE128505573AC9C57CBC4EDB7A880
SHA-256:	6A7C96FBCD87271F8DB3097A402449E6B0274B44CD7714CF669FFDF3648B462E
SHA-512:	4E4C6368670A4665CC96260828B3D1162A81ED5C0C69B1FD9410BD33641BCC0C9FB58C33B371814909D4028336142737072A23903A2F5F79D477353434651123
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.5.4.3.7.7.0.6.2.3.6.0.7.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.5.4.3.7.7.1.0.6.1.1.0.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.e.2.3.3.a.8.3.-.7.6.a.7.-.4.0.0.5.-.9.f.0.1.-.5.3.4.3.1.5.1.7.d.8.4.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.8.f.8.6.3.7.3.-.7.c.e.2.-.4.3.5.e.-.b.7.c.c.-.3.c.6.b.3.4.8.e.9.9.0.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.r.o.s.s.D.e.v.i.c.e.S.e.t.t.i.n.g.s.H.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.3.8.-.0.0.0.1.-.0.0.1.4.-.9.7.3.2.-.7.3.6.9.3.f.9.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.6.7.a.b.c.f.8.d.6.c.2.5.2.9.7.e.d.9.7.2.3.e.f.1.6.c.3.8.f.3.6.0.0.0.0.0.9.1.0.!.0.0.0.0.a.4.6.4.8.2.d.b.5.0.7.c.f.6.7.3.0.7.8.8.0.9.1.9.b.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE18D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 25 18:36:10 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	113152
Entropy (8bit):	1.9317664069502896
Encrypted:	false
SSDEEP:	384:3bFHw+BngDFtvVgikOq1LhrZeVQ39VS1LSqOawiub9df9KbauKs3a:LxtKFtvVgnWmS1Eiub9bs3
MD5:	6E2438F20256A9A50A0F1F4810EBB72D
SHA1:	1325A7D4912E268D148D1B78CB91752CA42AF015
SHA-256:	D248BABBB4E0B5378C1A1995F58ABB77A666FF94248A14E49550736484BAB386
SHA-512:	D616F3DD36D0C822BF7AB98AFD8BC7BE996C5A7079005201C10453A801538925B1019CDF52FC563892D71E9055A7E27479232B19918D3E9450978EE5CA64197B
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........f....................................l....#...........L..........`.......8...........T............J..@o...........#...........%..............................................................................eJ.......&......GenuineIntel............T.......8.....f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE298.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8368
Entropy (8bit):	3.697472332510983
Encrypted:	false
SSDEEP:	192:R6l7wVeJpCT6WMc6YEIBSU9GTgmfB5gJjrpr+89bAmsfBgm:R6lXJQ6W6YEuSU9GTgmf/gJjRAFfz
MD5:	CFDBEF364D764198515BBD1EE305FA4D
SHA1:	0FA707640E777AEB24015E12A744E40874BD1565
SHA-256:	A1C9FD1C71815755D037034CD4AF23A744631BDD0E9DDF091A1B7F16BAF69B7F
SHA-512:	7810B20D8A071E30E9762AF0AFF5090F7CED065BB99FB354323E231092B6DD0DB85EC474363374B45C7043F858C23FE4E2257288277BFF06E5F87BCA232FD2C3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.6.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2C8.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4698
Entropy (8bit):	4.506450043460758
Encrypted:	false
SSDEEP:	48:cvIwWl8zsqNJg77aI9VSWpW8VYqYm8M4Jd7oFy+q8QxjnlBB+hffd:uIjfqnI77z7VmJBRPB+hnd
MD5:	2062EE7DE8C639ACAE8076323AF8C10E
SHA1:	E2399EC81573C176CB3DF96782C2FF1C4F759398
SHA-256:	18A445CAD893D5720DE19FAF2FFACD70E68AFEC63F5A47971ACC840DA0CCD37E
SHA-512:	88E5E2F4270EC72F4A930F5A6C5FD53183C2890CF867D78AA370A54D20AA32D03540DFA65B9AC8D03B59A73B1E6D709A822449A2ECEA66041427B04036EF412D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="295778" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0C0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 25 18:36:14 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	112740
Entropy (8bit):	1.9240190142886622
Encrypted:	false
SSDEEP:	384:btcrGfcsFtvYn6xUuw27jtKt3pR9Sir7rHJ7w9RbVVJSdxhWqD:b6CcsFtv7G9Qjkt3vsi+h2f
MD5:	ADEBCF41CB298CD13BCE138A388D7CCB
SHA1:	A5482CDDF717D1276C5098000BD61DBAE7E990F8
SHA-256:	266357D502B355447B124144E40970477DCFF1DF6509C6C846DD9AEE559A0655
SHA-512:	9568C9AFB7F6C5B7D94AA3D3425E9040ADC6C19570161474C4FBCD64190EDACE393405EF3C865CD3C677F622984229DB6A856741DD762751FCDB63D97DCD40C4
Malicious:	false
Preview:	MDMP..a..... .........f....................................l....#...........L..........`.......8...........T............I...n...........#...........%..............................................................................eJ.......&......GenuineIntel............T.......X.....f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF18C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6368
Entropy (8bit):	3.7216010373687767
Encrypted:	false
SSDEEP:	192:R6l7wVeJFum6fwiYilgJjHyprQ89bkDsfxsm:R6lXJ16fwiY4gJjHikofP
MD5:	BA9C6D5F816429E2887153188FEF8CEC
SHA1:	16CF897E5B11ECF2C5541C6353B980A40D6A5A45
SHA-256:	2F856714ED115C41886F330E9A8A088015683619456877CFBA97047245322E33
SHA-512:	825C0C8322060B825D7E6769FD586F6E41372A086F08797F144CA2C821AADD5BDE1BD358C96FCB53C60AE935204FB12D53CF658C110962475B1E42F952278F31
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1AC.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4718
Entropy (8bit):	4.523888492847346
Encrypted:	false
SSDEEP:	48:cvIwWl8zsqNJg77aI9VSWpW8VY7Ym8M4JR7tYF6O+q87DvDnlBKlFfd:uIjfqnI77z7VHJ+unPKlZd
MD5:	96164ED145EC177D5FADCC6FCE1EAC7F
SHA1:	BA28D0FD512229C136933C875234D2FDAA426B0F
SHA-256:	7E8CE5BDE813E573100A501EF038CCBF0A629D1911FB74234F219E9A0CEEB97D
SHA-512:	B035E80C214DC8CEB3002D8E5F6461079BFEC6C3A589A2ECD0B4198E2F6C32C4505F1D20CE57D43713BEC7DC478E815E69263FCB4DFE8FC9167B75687F66EB2F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="295778" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2270736
Entropy (8bit):	7.922698187069996
Encrypted:	false
SSDEEP:	49152:Pwr0j3Y/qI2SgJeK3pJ3uwkeUB+C+26jAaa7V03:PW0j3YSI2SgJeKj3tjUcC+26jAaMa
MD5:	6795EFBA98699A0CAE3C4F729B83ACE9
SHA1:	A46482DB507CF67307880919B85DC2187D2A2512
SHA-256:	026387AA4411DAC1107E403FB44FA90C5A34EC5AB0068AF13E3F8F9F0B0F46CD
SHA-512:	12D49B08FEC9DFC8EFCDDD9CFC7BDD3930EBC128F21667DA11FC5AB1B80BA5F153608460275CF4F71695ED9B8B91BDF35261A099314B7EA10B39F000EDA1A101
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32% Antivirus: Virustotal, Detection: 39%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L...^.%f...............'............X.P...........@...........................h......#...@.......................................... ........................h.................................................................@................... ............................ ..` Z{..........................@..@ 0I... ......................@... .....p......................@..@ ..... ...L..................@..B.vm_sec..@.......@...$..............@....idata...............d..............@....tls.................h...................rsrc........ .......j..............@..@.themida. 5.......... ..............`....boot.........P...... ..............`..`.reloc........h.......".

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\1YMX7UxRgh318S1TWXmjgUx.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	7.724912083380178
Encrypted:	false
SSDEEP:	48:9Ta8L8DZI60IvbKzKOVh9yWQzmMFSStz4yd5L3u69j7d1CFTYZm8Qn3KJ6jkFOhz:d8DzbMhQNzFSCz4yd5u6rn88Q3KJw
MD5:	8CC6A5739AB545439C2DD0D4BEF562FF
SHA1:	E167433FF23B1E4566F5F4CDCB2DD1F4089965B6
SHA-256:	24588B1158C0AD2A70E5D09A1B2A4CA5AB0FA985E78EED23F67ECDF6744C729B
SHA-512:	9E96BCE5E3E872659ABABA4C726529A159E787AA6931D9EE6B676BC721EB0A05313E8B06B80CE372634327E4078FC4749D66DD3D655199757559565FE1CF564E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\1YMX7UxRgh318S1TWXmjgUx.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........X..E.............Cookies\Chrome_Default.txt....P.@.5.....d...`\|L2J1l.. .3."_..N.......q..b..=../c.;{.........4F8...0..Y.........Z}Y.g.<w3.f.W(....K.o..l...!.......y.o;.F..5%.....\|0MS.....J.,....../.o...8.H...,M.......;.....I!.z.W....j...e....fE.?.X....6...g...skL.K.85b.U.5...[/.<.h....C..\|...C5"{..i.$...'..W).f.O.i..4.....L..Z..t.Z(].2.m.?..<....]........f..I3?.q..8U.6...8.N.y_#Vb...g.k?.Z1.!.3$.....\.%...PK...........X.../W...........information.txtuX[O.F.~...0R_@.x...B.%.M7%d...0.'a.c....U.{....;.BH.7g...u<>..4...>Uy......!a^...{.te...qK.6..>.t(.F....D.63W..$2L....q..@....q....2...EBU.w9.e..B..t.X....3.c..B..Z...........Z...P...........y.x..<..z....aZ.B...~.L/.c&.....L.w..O.-..y..?.t.g...f.l...:}.5..CU.....k....2....).(.=.sO).....{.&t...JuV.~.....m.\|i.<.....Y...C..A.%...........2..C.!..g............Dj...:d..T...S..e.xHw.....Eg..^.F..F.~...r]$o+.."[..\|$'..V&!.6[%...\|.\j...[[...G....}.@

C:\Users\user\AppData\Local\Temp\HCwgibNvhQ3gDx_DWG1aNau.zip

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	2764
Entropy (8bit):	7.729288967206039
Encrypted:	false
SSDEEP:	48:98afL8DZIMof+LW18FT0aFrfsWbKP6ZvUzYxfan3KJ6Uk2OD5w:B8D3L750auEKCdUExfa3KJH
MD5:	DF77B676461130A8CCEBA7051302F12C
SHA1:	41B82B78AAEFD7C7D76243B59E5FF6A02DAD67FA
SHA-256:	762195FA85706A4EA797BB947F7282FDC9FE53B2F0B69221619510A43A2DD637
SHA-512:	52502C5C269DDCBA463F1E6A036BC4ED32DF31BCA47BAFD980BAC80287BFB68E4BA1FA1622127C13BFFFCD9EB4FA0236A636A08DB8362AA2E79D5A2FE1B1244C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\HCwgibNvhQ3gDx_DWG1aNau.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........X..E.............Cookies\Chrome_Default.txt....P.@.5.....d...`\|L2J1l.. .3."_..N.......q..b..=../c.;{.........4F8...0..Y.........Z}Y.g.<w3.f.W(....K.o..l...!.......y.o;.F..5%.....\|0MS.....J.,....../.o...8.H...,M.......;.....I!.z.W....j...e....fE.?.X....6...g...skL.K.85b.U.5...[/.<.h....C..\|...C5"{..i.$...'..W).f.O.i..4.....L..Z..t.Z(].2.m.?..<....]........f..I3?.q..8U.6...8.N.y_#Vb...g.k?.Z1.!.3$.....\.%...PK...........X).3.P...........information.txtuX[O.F.~...0R_@.x...B......j..&.$..#..U.{.....R..s.s....6M.$..\|8.j....0/.....].1.~..MA.O8..5..~p9.......D.I.0.(......"N.#_P..a.H....nj....q $.)...c.........)..p0...y..F.(.<0..E...Bjx^2..5....d2..)..{...?1%x.._..xfg....NNl...m6....:..6..}U...?..._....t>.....\|.).qA..zO..f.+9.R.Uz8.v>#.G...iy8&# `.$..d..0JfEN.vJ.=.L..f[........3.Rrw{y.....f."5..rK..d.M...).t.2a<.;.Iz]....V.`..F..p..</r]$/+..4[..\| .7..LB>.l...C.w..@J.mM.....:...Y.....

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:LoSRVEXln:MSzEXl
MD5:	1718F4856FAEE16D9A94A63833EEAE66
SHA1:	1E27481DAE1B52B8A68B62EADE6C42C6702C28CA
SHA-256:	4228B03103BAB372EDE19320672098001F3DFC4441161DF9F20DBB115AF3BAD6
SHA-512:	76141245D749500B0B4A4B2C1DCD03982F20504504AA886BCE8C62961809353ED0D8F49AC5F946B7D7410C099A80C642E9D8A7036C4F31C5AA8E298DBA0A2806
Malicious:	false
Preview:	1714074018273

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\3INegG9g_MMlWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\97CwebNjFmiiHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\9xtv4_r0ULbpHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\A0nn51lsZJRNHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\MQHnFYhPldB3Web Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\NwbTBYLMclw6Web Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\OhQNgUJ0X5NgLogin Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\XQcivVrU5A5HWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\Y9g_BlDmKPtZWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\gUON0R4KuJ74Cookies

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\m3tOv5lvb9V0History

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\sdYAsTf3586cLogin Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\siP8GPpHPPEwCookies

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\vfVkgJBrrUDWWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span68JizlX_sufx\zvXv7gzjmXYkLogin Data For Account

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\6UYtHiDj5kF4Web Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\7PzLqHtz21igLogin Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\ATGc9MJX9PreWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\FnKWlcBrreY1Web Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\NMxkTlMy11FaLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\PVnzSVZUtU5KHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\S0Pov5vdwAn3Login Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\Tuv7Vpshq2JqHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\_sFxHwGCbLcsCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\aRmFUB4TfJpPWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\aVbhqrHeZ9kZHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\nKeiourMZbKyHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\tQzi7j4yFcLSWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\uRAVepYZlvuOCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFqsK1kll1Gc3\zeSJ9T1kwjwWWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy68JizlX_sufx\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.999391385907715
Encrypted:	false
SSDEEP:	12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
MD5:	06ED2CD304730F55A5C7001509E128BE
SHA1:	49651485B2CE3D239172BD52BF5A265AB3EB8E18
SHA-256:	66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
SHA-512:	0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
Malicious:	false
Preview:	.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.TRUE./.TRUE.1712238015.NID.ENC893_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=..

C:\Users\user\AppData\Local\Temp\trixy68JizlX_sufx\information.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	5133
Entropy (8bit):	5.353395535136237
Encrypted:	false
SSDEEP:	96:xN3JZZRyQc2KBhA6tsxODsB8LOByfagYUfL2yo+yU/maAD5sj5BcawJksEdOSPL4:xvcQX6tsxPdB
MD5:	514CAF66911FDF8087E7D095CFD82092
SHA1:	D1878DFDF7831A4E7CE73FC55148E59FC307CA1D
SHA-256:	85C47FE755066C693F5D64C00BF50D01A23E76CF3DB4A5C09E2C087480E0D4C3
SHA-512:	572D365D46B36EDF282071E411AEC0DD7F13B8A466A3C145B6821EE469B6049E13DC22007086556B9C0A07DCC389922EAD599ED13DD4044D4CEDA12F04CDCD3D
Malicious:	false
Preview:	Build: nikto..Version: 1.9....Date: Thu Apr 25 20:36:06 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 286fe3198427e3eab9a8bb4a842f12d8....Path: C:\Users\user\Desktop\file.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy68JizlX_sufx....IP: 185.152.66.230..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 721680 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 25/4/2024 20:36:6..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost.exe [788].

C:\Users\user\AppData\Local\Temp\trixy68JizlX_sufx\passwords.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyFqsK1kll1Gc3\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.999391385907715
Encrypted:	false
SSDEEP:	12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
MD5:	06ED2CD304730F55A5C7001509E128BE
SHA1:	49651485B2CE3D239172BD52BF5A265AB3EB8E18
SHA-256:	66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
SHA-512:	0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
Malicious:	false
Preview:	.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.TRUE./.TRUE.1712238015.NID.ENC893_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=..

C:\Users\user\AppData\Local\Temp\trixyFqsK1kll1Gc3\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	5138
Entropy (8bit):	5.353184521641228
Encrypted:	false
SSDEEP:	96:xNqHZRyzc2KBhA6tsxODsB8LOByfagYUfL2yo+yU/maAD5sj5BcawJksEdOSPLCU:xmczX6tsxPsB
MD5:	2EC2C5CDB45780FF7C0723BA34D346D6
SHA1:	A8D27CC072B838184352C48021C05D0EFDB53E8F
SHA-256:	47C7F514C0306976C5D660280888435831C3F2EF9D36165BE6E079E9A992BC3A
SHA-512:	899F1028F8CC0C710510DCB7FAC6BD3DB3B2AFD59D224141DC388839569B50AB54E452568534747EEED235395773614DA096BA2E93F1C4804F585F88388FEB3C
Malicious:	false
Preview:	Build: nikto..Version: 1.9....Date: Thu Apr 25 20:36:09 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 286fe3198427e3eab9a8bb4a842f12d8....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyFqsK1kll1Gc3....IP: 185.152.66.230..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 721680 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 25/4/2024 20:36:9..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost.exe [7

C:\Users\user\AppData\Local\Temp\trixyFqsK1kll1Gc3\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4250758842935864
Encrypted:	false
SSDEEP:	6144:xSvfpi6ceLP/9skLmb0OTuWSPHaJG8nAgeMZMMhA2fX4WABlEnNp0uhiTw:IvloTuW+EZMM6DFyn03w
MD5:	59B0C195483CC249BAC1BF8F9A56531A
SHA1:	348AB84CEA116A49195795F4012B5EC5288758D1
SHA-256:	A4F7A9ED07744D86C89A5312BAFADF5A99173D41E229B72189E074119699FB5A
SHA-512:	47EE7DBD04D42CC999FD01DC8559A183398B80E539D4101C0FC870FEA69EAEBD5D121E712B8803B6EEAF61A0B29AB89D478DBE116E9435EEF037A5BC76241403
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...q?..................................................................................................................................................................................................................................................................................................................................................E........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.922698187069996
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'270'736 bytes
MD5:	6795efba98699a0cae3c4f729b83ace9
SHA1:	a46482db507cf67307880919b85dc2187d2a2512
SHA256:	026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd
SHA512:	12d49b08fec9dfc8efcddd9cfc7bdd3930ebc128f21667da11fc5ab1b80ba5f153608460275cf4f71695ed9b8b91bdf35261a099314b7ea10b39f000eda1a101
SSDEEP:	49152:Pwr0j3Y/qI2SgJeK3pJ3uwkeUB+C+26jAaa7V03:PW0j3YSI2SgJeKj3tjUcC+26jAaMa
TLSH:	0CB533EB7DD28805E1F6DA319860C6BB5844BF298D4811E568DF3F6FB63A70D9F04218
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	4c4d96ec0ce6c600

Static PE Info

General

Entrypoint:	0x900058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6625EF5E [Mon Apr 22 05:02:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	63814aaf116ba6abb6496ce4bcad24c6

Entrypoint Preview

Instruction
call 00007F7ACD457300h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F7ACD4571B7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F7ACD45719Ch
add dl, dl
jne 00007F7ACD4571B7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F7ACD457203h
xor eax, eax
add dl, dl
jne 00007F7ACD4571B7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F7ACD457297h
add dl, dl
jne 00007F7ACD4571B7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F7ACD4571B7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F7ACD4571B7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F7ACD4571B7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007F7ACD4571BAh
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007F7ACD45714Bh
mov eax, 00000001h
add dl, dl
jne 00007F7ACD4571B7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F7ACD4571B7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F7ACD45719Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007F7ACD4571DAh
mov ecx, 00000001h
add dl, dl
jne 00007F7ACD4571B7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007F7ACD4571B7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F7ACD45719Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1a018b	0x184	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a2000	0xb5ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x689000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1a1018	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x1803c4	0x40
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x158af8	0x7f400	43b587287b301430520c781e175e9bea	False	0.999460876105108	data	7.999486852289058	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x15a000	0x27b5a	0xc600	b02e27ba8a0a62e156f99ba3cb070840	False	0.9960345643939394	data	7.991658316031979	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x182000	0x4930	0x800	b16b287aa636bb2b4166cf7b1bd25fdd	False	0.90087890625	data	7.38511843248747	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x187000	0xafa0	0x1200	467cb5bda040e0a48312fe4e7d92180e	False	1.0023871527777777	data	7.957783824322694	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x192000	0x9700	0x4c00	e3f14cdb1bf1fe57ec354f844e79f7ad	False	0.9898745888157895	data	7.977428095826993	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.vm_sec	0x19c000	0x4000	0x4000	2574ee3be1d21a55cc02ed7334d12e05	False	0.165283203125	data	2.916830760368123	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x1a0000	0x1000	0x400	4b59baa1deb5678c423b5222ad87c2b8	False	0.400390625	data	3.337049343901853	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1a1000	0x1000	0x200	b6901c91578d4b57eb40e738bb0d9b8e	False	0.056640625	data	0.18120187678200297	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a2000	0xb600	0xb600	27507467f3af30f8a547dc012d3000e7	False	0.12386246565934066	data	2.4019871224080975	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x1ae000	0x352000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x500000	0x188600	0x188600	a4deabf04d831d68681bbad12d800249	False	0.9836040787273017	data	7.949192596228493	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x689000	0x1000	0x10	99df941ae8b9cb04221a0de4a710f9a9	False	1.5	GLS_BINARY_LSB_FIRST	2.349601752714581	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1a21e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Russian	Russia	0.1320921985815603
RT_ICON	0x1a2658	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1600	Russian	Russia	0.10465116279069768
RT_ICON	0x1a2d20	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Russian	Russia	0.08770491803278689
RT_ICON	0x1a36b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Russian	Russia	0.05722326454033771
RT_ICON	0x1a4770	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Russian	Russia	0.03475103734439834
RT_ICON	0x1a6d28	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	Russian	Russia	0.02509447331128956
RT_ICON	0x1aaf60	0x1aae	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.39780380673499266
RT_GROUP_ICON	0x1aca20	0x68	data	Russian	Russia	0.7596153846153846
RT_VERSION	0x1aca98	0x398	OpenPGP Public Key	Russian	Russia	0.42282608695652174
RT_MANIFEST	0x1ace40	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727
RT_MANIFEST	0x1acfd0	0x5d7	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.43478260869565216

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	wsprintfA
GDI32.dll	CreateCompatibleBitmap
ADVAPI32.dll	RegQueryValueExA
SHELL32.dll	ShellExecuteA
ole32.dll	CoInitialize
WS2_32.dll	WSAStartup
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders
SETUPAPI.dll	SetupDiEnumDeviceInfo
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/25/24-20:36:02.824956	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49708	147.45.47.93	192.168.2.5
04/25/24-20:36:09.524020	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49708	58709	192.168.2.5	147.45.47.93
04/25/24-20:36:02.835774	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49709	147.45.47.93	192.168.2.5
04/25/24-20:36:20.853335	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49724	147.45.47.93	192.168.2.5
04/25/24-20:36:03.375523	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49708	147.45.47.93	192.168.2.5
04/25/24-20:36:03.390482	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49709	147.45.47.93	192.168.2.5
04/25/24-20:36:00.328630	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49705	58709	192.168.2.5	147.45.47.93
04/25/24-20:36:23.977267	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49724	58709	192.168.2.5	147.45.47.93
04/25/24-20:36:00.782969	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49705	147.45.47.93	192.168.2.5
04/25/24-20:36:00.533633	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49705	147.45.47.93	192.168.2.5
04/25/24-20:36:14.063364	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49714	58709	192.168.2.5	147.45.47.93
04/25/24-20:36:07.671962	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49705	58709	192.168.2.5	147.45.47.93
04/25/24-20:36:10.545583	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49714	147.45.47.93	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 20:36:00.078001022 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:00.306992054 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:00.307205915 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:00.328629971 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:00.533632994 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:00.554939985 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:00.555064917 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:00.649142981 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:00.782968998 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:00.836429119 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:00.927450895 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:01.050957918 CEST	49706	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:01.050997972 CEST	443	49706	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:01.051075935 CEST	49706	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:01.053288937 CEST	49706	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:01.053308010 CEST	443	49706	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:01.291311979 CEST	443	49706	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:01.291388035 CEST	49706	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:01.294595957 CEST	49706	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:01.294606924 CEST	443	49706	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:01.295005083 CEST	443	49706	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:01.336431980 CEST	49706	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:01.421506882 CEST	49706	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:01.468122005 CEST	443	49706	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:01.561785936 CEST	443	49706	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:01.561942101 CEST	443	49706	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:01.562011003 CEST	49706	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:01.564281940 CEST	49706	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:01.564301968 CEST	443	49706	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:01.564316988 CEST	49706	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:01.564323902 CEST	443	49706	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:01.703481913 CEST	49707	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:01.703537941 CEST	443	49707	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:01.703632116 CEST	49707	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:01.704188108 CEST	49707	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:01.704205036 CEST	443	49707	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:01.942240000 CEST	443	49707	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:01.942320108 CEST	49707	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:01.946517944 CEST	49707	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:01.946523905 CEST	443	49707	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:01.946932077 CEST	443	49707	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:01.951870918 CEST	49707	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:01.996114969 CEST	443	49707	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:02.368273020 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:02.376425028 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:02.406610966 CEST	443	49707	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:02.406707048 CEST	443	49707	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:02.406759977 CEST	49707	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:02.408288002 CEST	49707	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:02.408302069 CEST	443	49707	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:02.408315897 CEST	49707	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:02.408320904 CEST	443	49707	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:02.408885956 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:02.596303940 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:02.596411943 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:02.601218939 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:02.601371050 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:02.609586000 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:02.609661102 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:02.664052963 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:02.711426973 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:02.742897987 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:02.824955940 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:02.835773945 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:02.867749929 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:02.882213116 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:02.883299112 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.021505117 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.322748899 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.367672920 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.375523090 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.390481949 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.399210930 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.430171967 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.445826054 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.508771896 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.508805037 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.508904934 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.510092020 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.510107040 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.513906956 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.513951063 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.514023066 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.515170097 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.515189886 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.637006998 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.637046099 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.637103081 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.637115955 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.637135029 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.637178898 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.637181997 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.637449026 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.637495041 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.637516022 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.637587070 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.637608051 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.637630939 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.637667894 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.637710094 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.658128023 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.661705971 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.670571089 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.670723915 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.736567974 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.736700058 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.738046885 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.738056898 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.738292933 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.750454903 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.750546932 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.751625061 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.751638889 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.752737999 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.785183907 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.802644968 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.828160048 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.844115019 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.863456964 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.863492966 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.863519907 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.863542080 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.863555908 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.863584995 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.863593102 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.863611937 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.863662004 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.945045948 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.945070028 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:03.945925951 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:03.987298012 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.987426043 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.987482071 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.988162041 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.988183022 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.988197088 CEST	49710	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.988203049 CEST	443	49710	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.990674973 CEST	49712	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:03.990699053 CEST	443	49712	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:03.990758896 CEST	49712	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:03.991092920 CEST	49712	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:03.991106987 CEST	443	49712	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:03.998975992 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.999279022 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.999351025 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.999468088 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.999486923 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:03.999496937 CEST	49711	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:03.999501944 CEST	443	49711	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:04.000864029 CEST	49713	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.000881910 CEST	443	49713	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.000945091 CEST	49713	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.001182079 CEST	49713	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.001197100 CEST	443	49713	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.182702065 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:04.223408937 CEST	443	49712	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.223561049 CEST	49712	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.224874020 CEST	49712	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.224883080 CEST	443	49712	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.225130081 CEST	443	49712	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.230415106 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:04.230421066 CEST	49712	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.236896038 CEST	443	49713	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.236980915 CEST	49713	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.239258051 CEST	49713	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.239269972 CEST	443	49713	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.239622116 CEST	443	49713	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.240823030 CEST	49713	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.274034023 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:04.276112080 CEST	443	49712	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.288115025 CEST	443	49713	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.511212111 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:04.548587084 CEST	443	49712	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.548691988 CEST	443	49712	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.548744917 CEST	49712	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.548953056 CEST	49712	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.548975945 CEST	443	49712	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.548986912 CEST	49712	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.549001932 CEST	443	49712	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.549288034 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:04.555161953 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:04.586124897 CEST	443	49713	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.586237907 CEST	443	49713	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.586288929 CEST	49713	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.586683035 CEST	49713	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.586699963 CEST	443	49713	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.586724997 CEST	49713	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:04.586730957 CEST	443	49713	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:04.587116003 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:04.796860933 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:04.842591047 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:04.852040052 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:04.884139061 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:04.915491104 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:04.954890966 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.153672934 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.195789099 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.215253115 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.247204065 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.258291960 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.292995930 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.483959913 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.483982086 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.484044075 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.484080076 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.484136105 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.484237909 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.484286070 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.484306097 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.484383106 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.484427929 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.484447956 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.484466076 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.484504938 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.484513998 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.484553099 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.545890093 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.545974970 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.546010971 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.546036005 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.546066046 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.546078920 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.546103001 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.546156883 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.546169043 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.546180964 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.546206951 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.546245098 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.546246052 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.546260118 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.546308994 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.709199905 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.709213018 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.709227085 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.709239960 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.709254026 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.709266901 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.709291935 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.709322929 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.773956060 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.774056911 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.774090052 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.774127007 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.774144888 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.774169922 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.774182081 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.774194002 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:05.774274111 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.808595896 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:05.836570024 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:06.043225050 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:06.086410999 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:06.105820894 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:06.133383989 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:06.148920059 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:06.164877892 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:06.372294903 CEST	58709	49709	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:06.403903008 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:06.414544106 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:06.445777893 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:07.671962023 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:07.974524975 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:08.100202084 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:08.100235939 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:08.326900005 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:08.326955080 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:08.327013016 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:08.599479914 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:08.624809027 CEST	49709	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:09.524019957 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:09.804445028 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:10.098737955 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:10.315531969 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:10.315589905 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:10.321965933 CEST	58709	49714	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:10.322392941 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:10.343131065 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:10.543984890 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:10.544009924 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:10.544044018 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:10.545583010 CEST	58709	49714	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:10.586410046 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:10.615001917 CEST	58709	49714	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:10.819722891 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:11.133434057 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:11.359956980 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:13.368256092 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:13.596198082 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:14.063364029 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:14.333990097 CEST	58709	49714	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:19.617116928 CEST	58709	49705	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:19.617194891 CEST	49705	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:20.400310040 CEST	49724	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:20.626588106 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:20.626701117 CEST	49724	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:20.640117884 CEST	49724	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:20.853334904 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:20.899060011 CEST	49724	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:20.911683083 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:23.011003971 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:23.011061907 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:23.133632898 CEST	58709	49708	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:23.133735895 CEST	49708	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:23.977267027 CEST	49724	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:24.255609989 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:32.031378031 CEST	58709	49714	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:32.086445093 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:32.309813976 CEST	58709	49714	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:32.352051973 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:33.020271063 CEST	49735	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:33.020318031 CEST	443	49735	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:33.020394087 CEST	49735	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:33.021594048 CEST	49735	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:33.021609068 CEST	443	49735	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:33.149137020 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:33.250822067 CEST	443	49735	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:33.250899076 CEST	49735	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:33.252784014 CEST	49735	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:33.252790928 CEST	443	49735	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:33.253041029 CEST	443	49735	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:33.301430941 CEST	49735	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:33.344161987 CEST	443	49735	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:33.427632093 CEST	58709	49714	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:33.503434896 CEST	443	49735	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:33.503537893 CEST	443	49735	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:33.503597975 CEST	49735	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:33.503887892 CEST	49735	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:33.503887892 CEST	49735	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:33.503916979 CEST	443	49735	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:33.503928900 CEST	443	49735	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:33.506259918 CEST	49736	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:33.506299973 CEST	443	49736	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:33.506391048 CEST	49736	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:33.506721973 CEST	49736	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:33.506742954 CEST	443	49736	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:33.735018969 CEST	443	49736	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:33.735169888 CEST	49736	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:33.736881018 CEST	49736	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:33.736903906 CEST	443	49736	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:33.737163067 CEST	443	49736	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:33.738483906 CEST	49736	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:33.780160904 CEST	443	49736	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:34.072405100 CEST	443	49736	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:34.072514057 CEST	443	49736	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:34.072573900 CEST	49736	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:34.072767019 CEST	49736	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:34.072778940 CEST	443	49736	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:34.072791100 CEST	49736	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:34.072796106 CEST	443	49736	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:34.073260069 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:34.349582911 CEST	58709	49714	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:34.351351023 CEST	58709	49714	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:34.398960114 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:34.399425983 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:34.677582026 CEST	58709	49714	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:35.009840012 CEST	58709	49714	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:35.055326939 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:38.070862055 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:38.293956041 CEST	58709	49714	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:38.302947998 CEST	58709	49714	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:38.303045034 CEST	49714	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:39.747035027 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:39.789572001 CEST	49724	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:40.015747070 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:40.070833921 CEST	49724	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:40.128494024 CEST	49737	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:40.128595114 CEST	443	49737	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:40.128699064 CEST	49737	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:40.129731894 CEST	49737	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:40.129770994 CEST	443	49737	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:40.297020912 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:40.297350883 CEST	49724	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:40.355536938 CEST	443	49737	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:40.355680943 CEST	49737	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:40.357078075 CEST	49737	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:40.357093096 CEST	443	49737	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:40.357337952 CEST	443	49737	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:40.398953915 CEST	49737	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:40.404908895 CEST	49737	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:40.452116966 CEST	443	49737	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:40.568298101 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:40.608711004 CEST	443	49737	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:40.608927965 CEST	443	49737	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:40.609031916 CEST	49737	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:40.613902092 CEST	49737	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:40.613902092 CEST	49737	443	192.168.2.5	34.117.186.192
Apr 25, 2024 20:36:40.613945961 CEST	443	49737	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:40.613972902 CEST	443	49737	34.117.186.192	192.168.2.5
Apr 25, 2024 20:36:40.622412920 CEST	49738	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:40.622458935 CEST	443	49738	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:40.622522116 CEST	49738	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:40.622879982 CEST	49738	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:40.622898102 CEST	443	49738	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:40.855262041 CEST	443	49738	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:40.855391979 CEST	49738	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:40.856669903 CEST	49738	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:40.856698036 CEST	443	49738	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:40.856951952 CEST	443	49738	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:40.858151913 CEST	49738	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:40.900124073 CEST	443	49738	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:41.176826000 CEST	443	49738	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:41.176948071 CEST	443	49738	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:41.177133083 CEST	49738	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:41.177594900 CEST	49738	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:41.177639961 CEST	443	49738	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:41.177666903 CEST	49738	443	192.168.2.5	104.26.5.15
Apr 25, 2024 20:36:41.177674055 CEST	443	49738	104.26.5.15	192.168.2.5
Apr 25, 2024 20:36:41.178153992 CEST	49724	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:41.458643913 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:42.054054976 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:42.055356026 CEST	49724	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:42.333805084 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:45.040415049 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:45.086431980 CEST	49724	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:48.163853884 CEST	49724	58709	192.168.2.5	147.45.47.93
Apr 25, 2024 20:36:48.390183926 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:48.396677971 CEST	58709	49724	147.45.47.93	192.168.2.5
Apr 25, 2024 20:36:48.396748066 CEST	49724	58709	192.168.2.5	147.45.47.93

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 20:36:00.932415962 CEST	49349	53	192.168.2.5	1.1.1.1
Apr 25, 2024 20:36:01.042365074 CEST	53	49349	1.1.1.1	192.168.2.5
Apr 25, 2024 20:36:01.587227106 CEST	61447	53	192.168.2.5	1.1.1.1
Apr 25, 2024 20:36:01.698996067 CEST	53	61447	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 20:36:00.932415962 CEST	192.168.2.5	1.1.1.1	0x80b6	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:01.587227106 CEST	192.168.2.5	1.1.1.1	0x9515	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 20:36:01.042365074 CEST	1.1.1.1	192.168.2.5	0x80b6	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:01.698996067 CEST	1.1.1.1	192.168.2.5	0x9515	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:01.698996067 CEST	1.1.1.1	192.168.2.5	0x9515	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
Apr 25, 2024 20:36:01.698996067 CEST	1.1.1.1	192.168.2.5	0x9515	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	34.117.186.192	443	5688	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:01 UTC	239	OUT	GET /widget/demo/185.152.66.230 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-25 18:36:01 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 25 Apr 2024 18:36:01 GMT content-type: application/json; charset=utf-8 Content-Length: 1052 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 18:36:01 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 31 38 35 2d 31 35 32 2d 36 36 2d 32 33 30 2e 64 61 74 61 70 61 63 6b 65 74 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 36 30 30 36 38 20 44 61 74 61 63 61 6d 70 20 4c 69 Data Ascii: { "input": "185.152.66.230", "data": { "ip": "185.152.66.230", "hostname": "unn-185-152-66-230.datapacket.com", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS60068 Datacamp Li
2024-04-25 18:36:01 UTC	311	IN	Data Raw: 3a 20 22 43 79 62 65 72 47 68 6f 73 74 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 38 35 Data Ascii: : "CyberGhost" }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "network": "185

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	104.26.5.15	443	5688	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:01 UTC	263	OUT	GET /demo/home.php?s=185.152.66.230 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-25 18:36:02 UTC	664	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:02 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC45460E:F270_93878F2E:0050_662AA292_9DF5401:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wilj9%2FVC%2FNPeDlvx0SbO%2FYDYSWUyeKhnera62KZAuDTHvE8qy4Wrb%2BUN6f8EFF%2B24iiDoaepWyuA%2B85uk5PRXbPX82fpJa1FwzOqwIyw4WNzwb5BCh%2ByyD%2FJfA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a06fb15e7344dd-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:02 UTC	675	IN	Data Raw: 32 39 63 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 Data Ascii: 29c{"status":"ok","demoInfo":{"ipAddress":"185.152.66.230","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages
2024-04-25 18:36:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	34.117.186.192	443	1896	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:03 UTC	239	OUT	GET /widget/demo/185.152.66.230 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-25 18:36:03 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 25 Apr 2024 18:36:03 GMT content-type: application/json; charset=utf-8 Content-Length: 1052 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 18:36:03 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 31 38 35 2d 31 35 32 2d 36 36 2d 32 33 30 2e 64 61 74 61 70 61 63 6b 65 74 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 36 30 30 36 38 20 44 61 74 61 63 61 6d 70 20 4c 69 Data Ascii: { "input": "185.152.66.230", "data": { "ip": "185.152.66.230", "hostname": "unn-185-152-66-230.datapacket.com", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS60068 Datacamp Li
2024-04-25 18:36:03 UTC	311	IN	Data Raw: 3a 20 22 43 79 62 65 72 47 68 6f 73 74 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 38 35 Data Ascii: : "CyberGhost" }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "network": "185

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	34.117.186.192	443	3160	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:03 UTC	239	OUT	GET /widget/demo/185.152.66.230 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-25 18:36:03 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 25 Apr 2024 18:36:03 GMT content-type: application/json; charset=utf-8 Content-Length: 1052 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 18:36:03 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 31 38 35 2d 31 35 32 2d 36 36 2d 32 33 30 2e 64 61 74 61 70 61 63 6b 65 74 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 36 30 30 36 38 20 44 61 74 61 63 61 6d 70 20 4c 69 Data Ascii: { "input": "185.152.66.230", "data": { "ip": "185.152.66.230", "hostname": "unn-185-152-66-230.datapacket.com", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS60068 Datacamp Li
2024-04-25 18:36:03 UTC	311	IN	Data Raw: 3a 20 22 43 79 62 65 72 47 68 6f 73 74 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 38 35 Data Ascii: : "CyberGhost" }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "network": "185

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49712	104.26.5.15	443	1896	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:04 UTC	263	OUT	GET /demo/home.php?s=185.152.66.230 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-25 18:36:04 UTC	654	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:04 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC4547DA:93BC_93878F2E:0050_662AA294_9DC9D97:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=20yVzj%2FDc4%2BSi9n0FwsW5b1dsNSvaWO80Yj9meqddJTF2lVd4HFNL54STrwcgXz7jcidJmiMA6dhv3ExNUBUZ%2FR9fXffzgCV6R1eucIFKeIlVLfGqXlrnuij9w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a06fbfaa064529-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:04 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-25 18:36:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49713	104.26.5.15	443	3160	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:04 UTC	263	OUT	GET /demo/home.php?s=185.152.66.230 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-25 18:36:04 UTC	656	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:04 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC454745:D82C_93878F2E:0050_662AA294_9DF5439:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XOz1YHa990aI6n9F6i2N%2FqPH2aVZfg9ZRJR5rVbmous%2BJLRLFbbMuU7XPJoeJ66X8JOeNzCj64EDJNiQCrlOt1Z4W0us46%2F2r4O3MTiBjkh%2FiMmW8zhK13dR1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a06fbfbccf676a-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:04 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-25 18:36:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49735	34.117.186.192	443	6984	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:33 UTC	239	OUT	GET /widget/demo/185.152.66.230 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-25 18:36:33 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 25 Apr 2024 18:36:33 GMT content-type: application/json; charset=utf-8 Content-Length: 1052 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 18:36:33 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 31 38 35 2d 31 35 32 2d 36 36 2d 32 33 30 2e 64 61 74 61 70 61 63 6b 65 74 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 36 30 30 36 38 20 44 61 74 61 63 61 6d 70 20 4c 69 Data Ascii: { "input": "185.152.66.230", "data": { "ip": "185.152.66.230", "hostname": "unn-185-152-66-230.datapacket.com", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS60068 Datacamp Li
2024-04-25 18:36:33 UTC	311	IN	Data Raw: 3a 20 22 43 79 62 65 72 47 68 6f 73 74 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 38 35 Data Ascii: : "CyberGhost" }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "network": "185

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49736	104.26.5.15	443	6984	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:33 UTC	263	OUT	GET /demo/home.php?s=185.152.66.230 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-25 18:36:34 UTC	654	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:34 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC454652:9314_93878F2E:0050_662AA2B1_9DCA07F:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WyTWbxILDScup5AwhaQ7%2F3nehb2PN9p6VcC%2BZu3qx7CwH8CHyv7b45vQJViAmDn1szWgM6kFQPjWnrqdKw4LrvpiEXs804coItj1hZ3WsFtlLxNQ0ip%2BpJ8KMA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a07078193d6787-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:34 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-25 18:36:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49737	34.117.186.192	443	4204	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:40 UTC	239	OUT	GET /widget/demo/185.152.66.230 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-25 18:36:40 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 25 Apr 2024 18:36:40 GMT content-type: application/json; charset=utf-8 Content-Length: 1052 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 4 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 18:36:40 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 31 38 35 2d 31 35 32 2d 36 36 2d 32 33 30 2e 64 61 74 61 70 61 63 6b 65 74 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 36 30 30 36 38 20 44 61 74 61 63 61 6d 70 20 4c 69 Data Ascii: { "input": "185.152.66.230", "data": { "ip": "185.152.66.230", "hostname": "unn-185-152-66-230.datapacket.com", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS60068 Datacamp Li
2024-04-25 18:36:40 UTC	311	IN	Data Raw: 3a 20 22 43 79 62 65 72 47 68 6f 73 74 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 38 35 Data Ascii: : "CyberGhost" }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "network": "185

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49738	104.26.5.15	443	4204	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 18:36:40 UTC	263	OUT	GET /demo/home.php?s=185.152.66.230 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-25 18:36:41 UTC	654	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 18:36:41 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471EBF:56C0_93878F2E:0050_662AA2B9_9DCA121:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BYLU3AdwzGky3oD4U6K3xyupQPERfmGxF05yY5UwMa1zJWyAQWYGlrSn4TVXZronIBeDRUTf%2BRlmPne6ay5n7e1BHeGbRekA%2F33SheFiRh3r5jkViU%2FOuPK4MQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a070a49d937ba0-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 18:36:41 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-25 18:36:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:35:56
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7a0000
File size:	2'270'736 bytes
MD5 hash:	6795EFBA98699A0CAE3C4F729B83ACE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2325278165.0000000001423000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2326694552.0000000005DC4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2326694552.0000000005D90000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:35:58
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x660000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:35:58
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:35:58
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x660000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:35:58
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:35:59
Start date:	25/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x240000
File size:	2'270'736 bytes
MD5 hash:	6795EFBA98699A0CAE3C4F729B83ACE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.2333459442.00000000059B0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, Virustotal, Browse Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:35:59
Start date:	25/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x240000
File size:	2'270'736 bytes
MD5 hash:	6795EFBA98699A0CAE3C4F729B83ACE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:36:07
Start date:	25/04/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0xe00000
File size:	2'270'736 bytes
MD5 hash:	6795EFBA98699A0CAE3C4F729B83ACE9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs Detection: 39%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:36:10
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 1948
Imagebase:	0x160000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:36:14
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1152
Imagebase:	0x160000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:36:16
Start date:	25/04/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0xe00000
File size:	2'270'736 bytes
MD5 hash:	6795EFBA98699A0CAE3C4F729B83ACE9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	25.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	50.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	34

Executed Functions

Function 00847D20 Relevance: 350.8, APIs: 10, Strings: 179, Instructions: 20001COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00847D97

Part of subcall function 008633B0: FindFirstFileA.KERNELBASE(00000000,?), ref: 008634EF

Strings

v<Ea, xrefs: 0085C27B
v<Ea, xrefs: 00850E27
v<Ea, xrefs: 00854C76
v<Ea, xrefs: 0084DF59
v<Ea, xrefs: 00862DDD
v<Ea, xrefs: 00852FDE
v<Ea, xrefs: 00860969
v<Ea, xrefs: 0085AEFC
v<Ea, xrefs: 0085A538
v<Ea, xrefs: 00852EA5
v<Ea, xrefs: 00857CF1
v<Ea, xrefs: 00855AD6
v<Ea, xrefs: 0085F5C2
v<Ea, xrefs: 0084E22E
v<Ea, xrefs: 0085C146
v<Ea, xrefs: 0085F576
v<Ea, xrefs: 0086014E
v<Ea, xrefs: 008521A1
v<Ea, xrefs: 008505B7
v<Ea, xrefs: 00859690
v<Ea, xrefs: 0085E283
v<Ea, xrefs: 0084852A
v<Ea, xrefs: 0085196F
v<Ea, xrefs: 008611DD
v<Ea, xrefs: 00862BA9
v<Ea, xrefs: 00859078
v<Ea, xrefs: 0084E27A
v<Ea, xrefs: 00851D43
v<Ea, xrefs: 00862BF5
v<Ea, xrefs: 0086073D
v<Ea, xrefs: 0085AC21
v<Ea, xrefs: 008572FD
v<Ea, xrefs: 008626C3
v<Ea, xrefs: 00851A50
v<Ea, xrefs: 00861153
v<Ea, xrefs: 0085311A
v<Ea, xrefs: 00850C48
v<Ea, xrefs: 0084B16C
v<Ea, xrefs: 00856E7E
v<Ea, xrefs: 00859026
v<Ea, xrefs: 0085E45B
v<Ea, xrefs: 0085C7E9
v<Ea, xrefs: 00849AE3
v<Ea, xrefs: 00860673
v<Ea, xrefs: 008567D6
v<Ea, xrefs: 0085C198
v<Ea, xrefs: 00853B9F
v<Ea, xrefs: 00850CFC
v<Ea, xrefs: 00860A26
v<Ea, xrefs: 0084DE7C
v<Ea, xrefs: 00857B6A
v<Ea, xrefs: 00848B57
v<Ea, xrefs: 00850086
v<Ea, xrefs: 0084DFAB
v<Ea, xrefs: 00860517
v<Ea, xrefs: 0085FFF8
v<Ea, xrefs: 00856657
v<Ea, xrefs: 00862959
v<Ea, xrefs: 00853BEB
v<Ea, xrefs: 00854065
v<Ea, xrefs: 00854B47
v<Ea, xrefs: 00861028
v<Ea, xrefs: 00850D48
v<Ea, xrefs: 0086206C
v<Ea, xrefs: 00852C69
v<Ea, xrefs: 008555DA
cannot use operator[] with a string argument with , xrefs: 0084E8A5, 0084E8DD, 0084E930, 0084E965, 0084E99C, 00850872, 008508B0, 00850965, 008557A4, 0085583D, 0085B31D, 0085B484, 0085B4D9, 0085B52E, 0085B589, 0085B5DE, 0085B633, 0085B688, 0085B6DD, 0085B732, 0085D315, 0085D353, 0085D408, 0085F19A, 0085F1D8, 0085F28D, 00863298, 008632D0, 00863362
v<Ea, xrefs: 00857072
v<Ea, xrefs: 00861465
v<Ea, xrefs: 0085DBDC
v<Ea, xrefs: 008539E2
v<Ea, xrefs: 008575E4
v<Ea, xrefs: 00860280
v<Ea, xrefs: 00852F8C
v<Ea, xrefs: 0086122F
v<Ea, xrefs: 00862677
v<Ea, xrefs: 00854849
v<Ea, xrefs: 00861A86
v<Ea, xrefs: 00850DD5
v<Ea, xrefs: 00860B5E
v<Ea, xrefs: 0084B120
v<Ea, xrefs: 00849693
v<Ea, xrefs: 00859324
v<Ea, xrefs: 00862149
v<Ea, xrefs: 008528E3
v<Ea, xrefs: 0085DF50
v<Ea, xrefs: 008553D1
v<Ea, xrefs: 00853DBF
v<Ea, xrefs: 0085C2C7
v<Ea, xrefs: 0084BF12
v<Ea, xrefs: 00857CA5
v<Ea, xrefs: 0085E4AD
v<Ea, xrefs: 0085A75B
v<Ea, xrefs: 00852A0E
v<Ea, xrefs: 0085A312
v<Ea, xrefs: 0085945E
v<Ea, xrefs: 00860BAA
v<Ea, xrefs: 00862E29
v<Ea, xrefs: 00858F49
v<Ea, xrefs: 0085E7A6
v<Ea, xrefs: 00854019
v<Ea, xrefs: 00852EF1
v<Ea, xrefs: 00853D73
v<Ea, xrefs: 00859BAB
v<Ea, xrefs: 008615A0
v<Ea, xrefs: 008566A9
v<Ea, xrefs: 008530CE
v<Ea, xrefs: 00860ED1
v<Ea, xrefs: 008570BE
v<Ea, xrefs: 0085DBA8
v<Ea, xrefs: 0085989D
v<Ea, xrefs: 00855385
v<Ea, xrefs: 008629A5
v<Ea, xrefs: 0084F38F
v<Ea, xrefs: 008578D2
R~u, xrefs: 0084F86A
v<Ea, xrefs: 0085D535
v<Ea, xrefs: 00858BDC
v<Ea, xrefs: 00860A78
v<Ea, xrefs: 0085791E
v<Ea, xrefs: 008615EC
v<Ea, xrefs: 00856C71
v<Ea, xrefs: 0085AC6D
v<Ea, xrefs: 0086107A
v<Ea, xrefs: 00856F3A
v<Ea, xrefs: 00860789
v<Ea, xrefs: 00854B99
v<Ea, xrefs: 008624DB
v<Ea, xrefs: 008535B1
v<Ea, xrefs: 0084E53E
v<Ea, xrefs: 00861308
v<Ea, xrefs: 00852C1D
v<Ea, xrefs: 00848A68
v<Ea, xrefs: 0084C191
cannot use push_back() with , xrefs: 0084E46B, 0084E6E3, 00850717, 00850908, 00855646, 008557DE, 0085B379, 0085B3D0, 0085B424, 0085D1D3, 0085D3AB, 0085F089, 0085F230, 0086330A
v<Ea, xrefs: 00856BA7
v<Ea, xrefs: 008500D2
v<Ea, xrefs: 00862FDD
v<Ea, xrefs: 00857592
v<Ea, xrefs: 0085465C
v<Ea, xrefs: 0086219B
v<Ea, xrefs: 0085AF48
v<Ea, xrefs: 00862F91
v<Ea, xrefs: 0085D002
v<Ea, xrefs: 008620BE
v<Ea, xrefs: 00852859
v<Ea, xrefs: 0085191D
v<Ea, xrefs: 008600FC
v<Ea, xrefs: 00852935
v<Ea, xrefs: 00857508
v<Ea, xrefs: 008488EA
v<Ea, xrefs: 008614B7
v<Ea, xrefs: 008594B0
v<Ea, xrefs: 0084AFB5
v<Ea, xrefs: 0084FE1A
v<Ea, xrefs: 0085EF35
v<Ea, xrefs: 0085A9D8
v<Ea, xrefs: 00862527
v<Ea, xrefs: 00849542
v<Ea, xrefs: 00851FB5
v<Ea, xrefs: 00859F9C
v<Ea, xrefs: 00858F9B
v<Ea, xrefs: 0085B12B
v<Ea, xrefs: 0085A70F
v<Ea, xrefs: 00851F69
v<Ea, xrefs: 0085678A
v<Ea, xrefs: 008573DD
v<Ea, xrefs: 0084DECE
v<Ea, xrefs: 008523E1
v<Ea, xrefs: 0085C5A1
v<Ea, xrefs: 00848619
v<Ea, xrefs: 0085DE6D
v<Ea, xrefs: 00860234
v<Ea, xrefs: 00860F1D
v<Ea, xrefs: 0085D6CA
v<Ea, xrefs: 00853996
v<Ea, xrefs: 0085734F
v<Ea, xrefs: 0085D696
v<Ea, xrefs: 008576BD

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: R~u$cannot use operator[] with a string argument with $cannot use push_back() with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 2195519125-797077965
Opcode ID: e545b65548829ecc5b41a2d640c60ad57a7ad667bee75db5a910f7de9bd3429d
Instruction ID: b4911530d38d0b8aa4ebc17c9b23489bf0ba1ce4687b320b2a1cd04fd80e2fb5
Opcode Fuzzy Hash: e545b65548829ecc5b41a2d640c60ad57a7ad667bee75db5a910f7de9bd3429d
Instruction Fuzzy Hash: F2B4FEB0D052698BDB25CF68C984BEDBBB5BF49304F1082D9D849B7242DB746B84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0083CBF0 Relevance: 172.9, APIs: 6, Strings: 91, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 0083CD44
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0083CE42
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0083D035
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 0083F796

Part of subcall function 00884050: GetFileAttributesA.KERNELBASE ref: 008840AC
Part of subcall function 00884050: GetLastError.KERNEL32 ref: 008840B7

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000000), ref: 0083FA7D
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00840FAE

Strings

v<Ea, xrefs: 00840403
v<Ea, xrefs: 0083FC02
v<Ea, xrefs: 0083DED5
v<Ea, xrefs: 0083FABC
v<Ea, xrefs: 0083F85B
v<Ea, xrefs: 0083EEDE
v<Ea, xrefs: 0083FCCD
v<Ea, xrefs: 0083EFE9
v<Ea, xrefs: 00840830
v<Ea, xrefs: 008407E4
v<Ea, xrefs: 0083E85C
v<Ea, xrefs: 0083E05E
v<Ea, xrefs: 0083ED58
v<Ea, xrefs: 0083D68A
v<Ea, xrefs: 0083EC6F
v<Ea, xrefs: 008400CA
v<Ea, xrefs: 0083FEC5
v<Ea, xrefs: 0083FDDF
v<Ea, xrefs: 0083E938
v<Ea, xrefs: 008401E1
v<Ea, xrefs: 0083E80A
v<Ea, xrefs: 0083FE73
v<Ea, xrefs: 0083F8A7
v<Ea, xrefs: 0083EBE6
v<Ea, xrefs: 0083CECF
v<Ea, xrefs: 0083CDC3
v<Ea, xrefs: 0083CF85
v<Ea, xrefs: 008402F2
v<Ea, xrefs: 0083F0D8
v<Ea, xrefs: 0083EB9A
v<Ea, xrefs: 00840608
v<Ea, xrefs: 00840E83
v<Ea, xrefs: 00840654
v<Ea, xrefs: 0083D2FA
v<Ea, xrefs: 0083CFD8
v<Ea, xrefs: 0083E61F
v<Ea, xrefs: 00840022
v<Ea, xrefs: 0083E6FF
v<Ea, xrefs: 0083DE89
v<Ea, xrefs: 0083ECC1
v<Ea, xrefs: 00840D70
v<Ea, xrefs: 0083D2A8
v<Ea, xrefs: 0083FB0E
cannot use push_back() with , xrefs: 00841038
v<Ea, xrefs: 0083E0AA
v<Ea, xrefs: 00840D24
v<Ea, xrefs: 00840116
v<Ea, xrefs: 0083F12A
v<Ea, xrefs: 00840AA0
v<Ea, xrefs: 00840943
v<Ea, xrefs: 0083F972
v<Ea, xrefs: 0083EB03
v<Ea, xrefs: 008402A6
v<Ea, xrefs: 0084071F
v<Ea, xrefs: 0083E216
v<Ea, xrefs: 0083FBB6
v<Ea, xrefs: 0083F576
v<Ea, xrefs: 0083F4C8
v<Ea, xrefs: 00840B48
v<Ea, xrefs: 0083EDA4
cannot use operator[] with a string argument with , xrefs: 00841091, 008410E6
v<Ea, xrefs: 0083E6AD
XO4, xrefs: 0083D399
v<Ea, xrefs: 0083DA28
v<Ea, xrefs: 00840B94
v<Ea, xrefs: 0083D9DC
v<Ea, xrefs: 0083E5CD
v<Ea, xrefs: 0083F03B
v<Ea, xrefs: 0083FC7B
v<Ea, xrefs: 0083E262
v<Ea, xrefs: 0083FFD0
v<Ea, xrefs: 0084018F
v<Ea, xrefs: 0083D067
v<Ea, xrefs: 0083F3D9
v<Ea, xrefs: 008403B1
v<Ea, xrefs: 0083CE7D
v<Ea, xrefs: 0083F476
v<Ea, xrefs: 00840C5F
v<Ea, xrefs: 0083DC9A
v<Ea, xrefs: 0083D3E5
v<Ea, xrefs: 0083F920
v<Ea, xrefs: 0083F38D
v<Ea, xrefs: 00840560
v<Ea, xrefs: 0083DC4E
v<Ea, xrefs: 0083F6FC
v<Ea, xrefs: 0083F5C2
v<Ea, xrefs: 0083D21C
v<Ea, xrefs: 0083F27C
v<Ea, xrefs: 0083D0B3
v<Ea, xrefs: 0083EA1E
v<Ea, xrefs: 0083FD8D

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: XO4$cannot use operator[] with a string argument with $cannot use push_back() with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 2833034228-769388876
Opcode ID: b663b842af808f9cb4669c1b1aad7699098b245e6dd333e57b85b8f688322540
Instruction ID: 06c8b4da8151c25a644974470329e5bc323313245fba1d24b37b63e5729c45b8
Opcode Fuzzy Hash: b663b842af808f9cb4669c1b1aad7699098b245e6dd333e57b85b8f688322540
Instruction Fuzzy Hash: 8693BBB4D052A88ADB65CF28C995BEDBBB5AF49304F0082DAD949B7241DB742FC4CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0087D2B0 Relevance: 114.2, APIs: 50, Strings: 13, Instructions: 3939registrytimefileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 0087D4BB
CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00902B0C,00000001,0000002E,0000002F,?,008F83D1,3"{,008F83D1), ref: 0087D78B
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0087D906
FindNextFileA.KERNEL32(00000000,?), ref: 0087D91C
FindClose.KERNEL32(00000000), ref: 0087D92C
GetLastError.KERNEL32 ref: 0087D932
GetLastError.KERNEL32 ref: 0087D950

Part of subcall function 00884590: GetCurrentProcess.KERNEL32(0087DCB0), ref: 0088459F
Part of subcall function 00884590: IsWow64Process.KERNEL32(00000000), ref: 008845A6

Part of subcall function 007E195B: GetSystemTimeAsFileTime.KERNEL32(0087DE28,00000000,00000000,?,?,?,0087DE28,00000000), ref: 007E1970
Part of subcall function 007E195B: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007E198F

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?,?,?), ref: 0087E0E1
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 0087E1AD
RegCloseKey.ADVAPI32(?), ref: 0087E1E2
GetCurrentHwProfileA.ADVAPI32(?), ref: 0087E37A
GetModuleHandleExA.KERNEL32(00000004,00883370,?,?,?,?,?,?,?,?,00000000), ref: 0087E87B
GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,?,?,?,?,?,00000000), ref: 0087E893
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?), ref: 0087F246
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 0087F312
RegCloseKey.ADVAPI32(?), ref: 0087F591
GetComputerNameA.KERNEL32(?,?), ref: 0087F5C5
GetUserNameA.ADVAPI32(?,?), ref: 0087F763
GetDesktopWindow.USER32 ref: 0087F806
GetWindowRect.USER32(00000000,?), ref: 0087F814
GetUserDefaultLocaleName.KERNEL32(?,00000200), ref: 0087F97F
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0087FE45
LocalAlloc.KERNEL32(00000040), ref: 0087FE57
GetKeyboardLayoutList.USER32(?,00000000), ref: 0087FE72
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0087FE9D
LocalFree.KERNEL32(?), ref: 00880060
GetLocalTime.KERNEL32(?), ref: 00880077
GetSystemTime.KERNEL32(?), ref: 0088028D
GetTimeZoneInformation.KERNELBASE(?), ref: 008802B0
TzSpecificLocalTimeToSystemTime.KERNELBASE(?,?,?), ref: 008802D5
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 008806EF
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 00880841
RegCloseKey.ADVAPI32(?), ref: 008808F2
GetSystemInfo.KERNELBASE(?), ref: 0088091A
GlobalMemoryStatusEx.KERNELBASE(?), ref: 008809CD
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 00880AE1
EnumDisplayDevicesA.USER32(00000000,00000001,?,00000001), ref: 00880EC4
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00881003
Process32First.KERNEL32(00000000,?), ref: 0088101B
Process32Next.KERNEL32(00000000,?), ref: 00881031
Process32Next.KERNEL32(00000000,?), ref: 00881103
CloseHandle.KERNEL32(00000000), ref: 00881112
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 00881486
RegEnumKeyExA.KERNELBASE(?,00000000,?,?), ref: 008814BD
wsprintfA.USER32 ref: 008815A0
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 008815C3
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400), ref: 008816C2
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400), ref: 008817B9
RegCloseKey.ADVAPI32(?), ref: 00881895
RegCloseKey.ADVAPI32(?), ref: 008818B0

Strings

v<Ea, xrefs: 00880D13
v<Ea, xrefs: 0087FDDC
3"{, xrefs: 0087D376, 0087DA40, 0087D524, 0087D529, 0087D533
nikto, xrefs: 0087DCD4, 0087DD5E
1.9, xrefs: 0087DD77, 0087DE08
v<Ea, xrefs: 0088134F
|<Ea, xrefs: 008817F3
v<Ea, xrefs: 0087FF1A
v<Ea, xrefs: 0088174E
v<Ea, xrefs: 008814F7
v<Ea, xrefs: 00881657
v<Ea, xrefs: 008819DB
v<Ea, xrefs: 0088153D

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: CloseTime$FileOpenQueryValue$LocalNameSystem$EnumFindNextProcess32$CreateCurrentDevicesDisplayErrorFirstHandleInfoKeyboardLastLayoutListLocaleModuleProcessUserWindow$AllocComputerCopyDefaultDesktopDirectoryFreeGlobalInformationMemoryProfileRectSnapshotSpecificStatusToolhelp32Unothrow_t@std@@@Wow64Zone__ehfuncinfo$??2@wsprintf
String ID: 1.9$3"{$nikto$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$|<Ea
API String ID: 3185416054-850726101
Opcode ID: 06acbe5f1df3d908bfec5ece11389cc9c7e972b1d2d9473c163f07d421858555
Instruction ID: 30f5baa3e060fea63688ffb20a7f4093df8ad4d42d2e265e6709d4deb27ace62
Opcode Fuzzy Hash: 06acbe5f1df3d908bfec5ece11389cc9c7e972b1d2d9473c163f07d421858555
Instruction Fuzzy Hash: A3B3EFB4D0426DCBDB25CF98C985AEEBBB4BF48300F104199E948B7341DB746A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 007AB8E0 Relevance: 102.1, APIs: 40, Strings: 15, Instructions: 5855fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 007ABA08
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007ABAD2
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007ABF80
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007AC47A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007AC575
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007AC969
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007ACD72
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007AD17B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007AD29A
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007AD5FD
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007AD6F8
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007AD9DC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007ADAD7
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007ADE41
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007ADF3C
CopyFileA.KERNEL32(?,?,00000000), ref: 007AE55A
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007AECF6
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 007AEEEA
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007AF45B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007AF525
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007AFEF1
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 007B01ED
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 007B0580
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 007B088D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007B0DC4
CopyFileA.KERNEL32(?,?,00000000), ref: 007B173C
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007B1904
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 007B1CD7
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007B1E6E
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007B1FBE
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 007B0B14

Part of subcall function 0087D2B0: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00902B0C,00000001,0000002E,0000002F,?,008F83D1,3"{,008F83D1), ref: 0087D78B

CreateDirectoryA.KERNELBASE(?,00000000), ref: 007B0F12
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007AFC55

Part of subcall function 0087D2B0: FindFirstFileA.KERNEL32(00000000,?), ref: 0087D4BB

CreateDirectoryA.KERNELBASE(?,00000000), ref: 007AF933

Part of subcall function 00884050: std::_Throw_Cpp_error.LIBCPMT ref: 008840FF
Part of subcall function 00884050: std::_Throw_Cpp_error.LIBCPMT ref: 00884110

CreateDirectoryA.KERNELBASE(?,00000000), ref: 007AE6FA

Part of subcall function 008633B0: FindFirstFileA.KERNELBASE(00000000,?), ref: 008634EF

Part of subcall function 007C9070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 007C910D
Part of subcall function 007C9070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 007C9155

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 007ABB07

Part of subcall function 00884050: GetFileAttributesA.KERNELBASE ref: 008840AC
Part of subcall function 00884050: GetLastError.KERNEL32 ref: 008840B7

CreateDirectoryA.KERNELBASE(?,00000000), ref: 007ABD08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 007ABD37
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007AC0CC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007AC196

Strings

v<Ea, xrefs: 007B14A0
v<Ea, xrefs: 007B1390
v<Ea, xrefs: 007B127C
v<Ea, xrefs: 007AE040
v<Ea, xrefs: 007B14EC
v<Ea, xrefs: 007B12C8
v<Ea, xrefs: 007AE300
v<Ea, xrefs: 007B15AE
v<Ea, xrefs: 007AE244
v<Ea, xrefs: 007B13DC
v<Ea, xrefs: 007B1016
v<Ea, xrefs: 007B2177
v<Ea, xrefs: 007AE1F8
v<Ea, xrefs: 007AE34C
v<Ea, xrefs: 007AE414

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: CreateDirectory$File$Copy$Cpp_errorFindFirstFolderPathThrow____std_fs_convert_narrow_to_wide@20std::_$AttributesErrorLast
String ID: v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 3985928759-2632615832
Opcode ID: d5d0a39d30cc1ff87160334bb4627f45d52181905ad0fc5ce0134e19d74eb9d6
Instruction ID: 4ed92c29d0a8698f8176cae2ed0a71380bceb088e1968607f65ff9c92b918509
Opcode Fuzzy Hash: d5d0a39d30cc1ff87160334bb4627f45d52181905ad0fc5ce0134e19d74eb9d6
Instruction Fuzzy Hash: D2F3DFB4D0425DCBDB25CFA8C985AEEBBB0BF49300F104199D859B7341EB742A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00831A60 Relevance: 77.2, APIs: 12, Strings: 31, Instructions: 1966fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00831AC7

Part of subcall function 00884050: GetFileAttributesA.KERNELBASE ref: 008840AC
Part of subcall function 00884050: GetLastError.KERNEL32 ref: 008840B7

FindFirstFileA.KERNEL32(?,?), ref: 0083207F
FindNextFileA.KERNEL32(00000000,?), ref: 0083248C
FindClose.KERNEL32(00000000), ref: 0083249C
CreateDirectoryA.KERNEL32(?,00000000), ref: 00832573
CreateDirectoryA.KERNEL32(?,00000000), ref: 00832639
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 008327BD

Part of subcall function 00884050: std::_Throw_Cpp_error.LIBCPMT ref: 008840FF
Part of subcall function 00884050: std::_Throw_Cpp_error.LIBCPMT ref: 00884110

CreateDirectoryA.KERNEL32(?,00000000), ref: 00832964
CopyFileA.KERNEL32(00000000,?,00000000), ref: 00832C18
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00833158
CredEnumerateA.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?), ref: 0083351D
LocalFree.KERNELBASE(?), ref: 00833DF7

Part of subcall function 007D51EB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,18EC83FF,0080A937,?,007D1CF9,?,009169D8,0080A937,?,0080A937,-0000001C), ref: 007D524B

Strings

v<Ea, xrefs: 00832F96
v<Ea, xrefs: 008338F0
v<Ea, xrefs: 0083389E
v<Ea, xrefs: 00833B65
v<Ea, xrefs: 00833A2C
v<Ea, xrefs: 00833CC3
v<Ea, xrefs: 00832B7A
v<Ea, xrefs: 00832E96
v<Ea, xrefs: 0083285E
cannot use operator[] with a string argument with , xrefs: 00833E34, 00833E8E
v<Ea, xrefs: 00833C77
v<Ea, xrefs: 00833686
v<Ea, xrefs: 0083299C
v<Ea, xrefs: 00832DB4
v<Ea, xrefs: 0083275D
v<Ea, xrefs: 00832A5E
v<Ea, xrefs: 00832184
v<Ea, xrefs: 00833386
v<Ea, xrefs: 00833BB7
v<Ea, xrefs: 00832B28
v<Ea, xrefs: 00832AAA
v<Ea, xrefs: 008320CA
v<Ea, xrefs: 00832EE8
v<Ea, xrefs: 008336D2
v<Ea, xrefs: 008328B0
v<Ea, xrefs: 008329D6
v<Ea, xrefs: 008320FE
v<Ea, xrefs: 00832150
v<Ea, xrefs: 00832FE2
v<Ea, xrefs: 008330B2
v<Ea, xrefs: 008339DA

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: File$CopyCreateDirectoryFind$Cpp_errorThrow_std::_$AttributesCloseCredEnumerateErrorExceptionFirstFolderFreeLastLocalNextPathRaise
String ID: cannot use operator[] with a string argument with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 3528249430-249588351
Opcode ID: 9273e051131d7b294b76f1a789a47f84778887a2b98418029f946db547dcb86c
Instruction ID: 9c9cfe6f26a3cf82dac41e68686ffa3c554067adf5e644abc3613eabff8f25a5
Opcode Fuzzy Hash: 9273e051131d7b294b76f1a789a47f84778887a2b98418029f946db547dcb86c
Instruction Fuzzy Hash: 5E33ECB4D042A98BDB65CF68C895BEDBBB0BF49300F1082D9D858B7341EB746A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 008361D0 Relevance: 73.9, APIs: 4, Strings: 37, Instructions: 2129stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00836324
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00836422
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00836618
lstrlen.KERNEL32(?), ref: 00838931

Strings

v<Ea, xrefs: 00838359
v<Ea, xrefs: 00837E92
v<Ea, xrefs: 008377EF
v<Ea, xrefs: 008363A3
v<Ea, xrefs: 00836868
v<Ea, xrefs: 00838547
v<Ea, xrefs: 008387E5
cannot use operator[] with a string argument with , xrefs: 008389A3, 00838A39
v<Ea, xrefs: 008370CC
v<Ea, xrefs: 00837417
v<Ea, xrefs: 00836460
v<Ea, xrefs: 008373CB
v<Ea, xrefs: 008383A5
v<Ea, xrefs: 0083681C
v<Ea, xrefs: 00838151
v<Ea, xrefs: 00836568
v<Ea, xrefs: 00837AF5
v<Ea, xrefs: 0083664A
v<Ea, xrefs: 008377A3
v<Ea, xrefs: 00837CC2
v<Ea, xrefs: 00837C76
v<Ea, xrefs: 00836696
v<Ea, xrefs: 00838793
v<Ea, xrefs: 00836D92
v<Ea, xrefs: 00837E46
v<Ea, xrefs: 008364B2
v<Ea, xrefs: 00837AA9
v<Ea, xrefs: 0083761D
XO4, xrefs: 00836C62
v<Ea, xrefs: 00836CB4
v<Ea, xrefs: 00838593
v<Ea, xrefs: 00836AA8
v<Ea, xrefs: 008375D1
v<Ea, xrefs: 00836A5C
cannot use push_back() with , xrefs: 00838851, 008389DA
v<Ea, xrefs: 008365BB
v<Ea, xrefs: 00836D40

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: XO4$cannot use operator[] with a string argument with $cannot use push_back() with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 1311570089-1359732929
Opcode ID: fcae389ce93a88c346f46ae1c7e3768fa24369c6ba1fe0f563532558bd35b688
Instruction ID: cc814da3c89464c5d97326fad07b88a05856d66a2e3f1e500b3c4577dc743323
Opcode Fuzzy Hash: fcae389ce93a88c346f46ae1c7e3768fa24369c6ba1fe0f563532558bd35b688
Instruction Fuzzy Hash: 084301B0D052688BDB65CF28C894BEDBBB5BF49304F1082D9E449B7242DB756B84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 008749B0 Relevance: 64.1, APIs: 31, Strings: 2, Instructions: 6337fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,008F80C7,000000FF), ref: 00874A1C
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00874A43
CreateDirectoryA.KERNEL32(?,00000000), ref: 00874D09
CreateDirectoryA.KERNEL32(?,00000000), ref: 0087506B
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?), ref: 00875712
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 008759D3
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008761A7
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0087658D
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00876D42
CreateDirectoryA.KERNEL32(?,00000000), ref: 00877003
CreateDirectoryA.KERNEL32(?,00000000), ref: 008776CE
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0087779F
CreateDirectoryA.KERNEL32(?,00000000), ref: 00877AC2
CreateDirectoryA.KERNEL32(?,00000000), ref: 00877E2D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00877EFE
CreateDirectoryA.KERNEL32(?,00000000), ref: 008781E9
CreateDirectoryA.KERNEL32(?,00000000,?,?,?), ref: 00878479
CreateDirectoryA.KERNEL32(?,00000000), ref: 0087862C
CreateDirectoryA.KERNEL32(?,00000000), ref: 00878906
CreateDirectoryA.KERNEL32(?,00000000), ref: 00878CEC
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?), ref: 008790A1
CreateDirectoryA.KERNEL32(?,00000000), ref: 00879254
CreateDirectoryA.KERNEL32(?,00000000), ref: 0087952E
CreateDirectoryA.KERNEL32(?,00000000), ref: 00879914
CreateDirectoryA.KERNEL32(?,00000000), ref: 00877363

Part of subcall function 0087D2B0: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0087D906
Part of subcall function 0087D2B0: GetLastError.KERNEL32 ref: 0087D950

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 008769F8

Part of subcall function 0087D2B0: FindNextFileA.KERNEL32(00000000,?), ref: 0087D91C
Part of subcall function 0087D2B0: FindClose.KERNEL32(00000000), ref: 0087D92C
Part of subcall function 0087D2B0: GetLastError.KERNEL32 ref: 0087D932

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 00875D1A

Part of subcall function 0087D2B0: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00902B0C,00000001,0000002E,0000002F,?,008F83D1,3"{,008F83D1), ref: 0087D78B

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00875ECD
CreateDirectoryA.KERNEL32(?,00000000), ref: 008753CB

Part of subcall function 0087D2B0: FindFirstFileA.KERNEL32(00000000,?), ref: 0087D4BB

Part of subcall function 00884050: GetFileAttributesA.KERNELBASE ref: 008840AC
Part of subcall function 00884050: GetLastError.KERNEL32 ref: 008840B7

Part of subcall function 00884050: std::_Throw_Cpp_error.LIBCPMT ref: 008840FF
Part of subcall function 00884050: std::_Throw_Cpp_error.LIBCPMT ref: 00884110

CreateDirectoryA.KERNEL32(?,00000000), ref: 00879D4C
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00879EA3

Part of subcall function 0087B7E0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0087B84D

Strings

v<Ea, xrefs: 0087A158
v<Ea, xrefs: 0087B484

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: CreateDirectory$File$Copy$ErrorFindFolderLastPath$Cpp_errorThrow_std::_$AttributesCloseFirstNext
String ID: v<Ea$v<Ea
API String ID: 901091077-2190929436
Opcode ID: fe986636787d62fca5343ce109c980506b5e80469cfe76d1ca352d55efd7c260
Instruction ID: f83ebbe098512d53aaaa1b6b6c2c91f2b3866ca991b704fe687ef42d78e65ae3
Opcode Fuzzy Hash: fe986636787d62fca5343ce109c980506b5e80469cfe76d1ca352d55efd7c260
Instruction Fuzzy Hash: 78F3F1B4D04259CBDB15CFA8C995AEEBBB0BF49300F244199D949B7341E7706B84CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00838A80 Relevance: 59.6, APIs: 4, Strings: 29, Instructions: 1876stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 00838C78
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00838D85
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00838F78
lstrlen.KERNEL32(?), ref: 0083AD4D

Strings

v<Ea, xrefs: 008393BC
v<Ea, xrefs: 008396A0
v<Ea, xrefs: 0083A209
v<Ea, xrefs: 00838CFA
cannot use operator[] with a string argument with , xrefs: 0083ADBC, 0083AE73
v<Ea, xrefs: 0083AB1F
v<Ea, xrefs: 008396F2
v<Ea, xrefs: 00838FF6
v<Ea, xrefs: 0083917C
v<Ea, xrefs: 0083A7C3
v<Ea, xrefs: 0083A34F
v<Ea, xrefs: 00838DC0
v<Ea, xrefs: 008391C8
v<Ea, xrefs: 0083A556
v<Ea, xrefs: 00838EC8
v<Ea, xrefs: 00839EA9
v<Ea, xrefs: 00838E12
v<Ea, xrefs: 00839CFA
v<Ea, xrefs: 0083A80F
v<Ea, xrefs: 00839614
v<Ea, xrefs: 0083A5A2
v<Ea, xrefs: 00838FAA
v<Ea, xrefs: 00839CAB
v<Ea, xrefs: 00839408
v<Ea, xrefs: 0083A303
cannot use push_back() with , xrefs: 0083AC0A, 0083AE0C
v<Ea, xrefs: 00839A2C
v<Ea, xrefs: 0083A255
v<Ea, xrefs: 00838F1B

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 1311570089-2661975114
Opcode ID: 49841492a5e8327a235d8611b56c7320e89c47d426bb0f85e62d16c59f7860ce
Instruction ID: 59ffe55d302956a06e0df8dbb801adaab6b5548e1eededf15887697db02a58b3
Opcode Fuzzy Hash: 49841492a5e8327a235d8611b56c7320e89c47d426bb0f85e62d16c59f7860ce
Instruction Fuzzy Hash: BD23FFB0D052688BDB65CF28C8947EDBBB5BF49304F1082D9E849B7241EB746B85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00833ED0 Relevance: 56.0, APIs: 5, Strings: 26, Instructions: 1775stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00834024
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00834122
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00834315
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00835B98
lstrlen.KERNEL32(?), ref: 0083606F

Strings

v<Ea, xrefs: 00834393
v<Ea, xrefs: 00834A40
v<Ea, xrefs: 00834568
v<Ea, xrefs: 008349B4
v<Ea, xrefs: 00834A92
v<Ea, xrefs: 00835366
v<Ea, xrefs: 00835564
v<Ea, xrefs: 00834347
v<Ea, xrefs: 00835EC0
v<Ea, xrefs: 00835BFC
cannot use operator[] with a string argument with , xrefs: 008360DE, 00836190
v<Ea, xrefs: 008341AF
v<Ea, xrefs: 0083415D
v<Ea, xrefs: 008342B8
v<Ea, xrefs: 008353B5
v<Ea, xrefs: 00834F2C
v<Ea, xrefs: 008359A7
v<Ea, xrefs: 00835E6E
v<Ea, xrefs: 008340A3
v<Ea, xrefs: 00834265
v<Ea, xrefs: 008347A8
v<Ea, xrefs: 0083475C
v<Ea, xrefs: 0083451C
cannot use push_back() with , xrefs: 00835F2C, 0083612E
v<Ea, xrefs: 008359F3
v<Ea, xrefs: 00835C48

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 3203477177-515590595
Opcode ID: ac398fd56f8cc040d46f63e392a5d92e10c373cff2457239929836ba750334e0
Instruction ID: 18a4005e7198bd7b7c7816e7fb337a6d138b693f70fc7d33342cf41559051086
Opcode Fuzzy Hash: ac398fd56f8cc040d46f63e392a5d92e10c373cff2457239929836ba750334e0
Instruction Fuzzy Hash: 8C23FFB4D052688BDB65CF28C884BEDBBB5BF49304F1082D9E849A7241EB746F84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0083AEC0 Relevance: 55.8, APIs: 4, Strings: 27, Instructions: 1570stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 0083B014
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0083B112
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0083B305
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0083CA52

Strings

v<Ea, xrefs: 0083C2FE
v<Ea, xrefs: 0083C09C
v<Ea, xrefs: 0083BB70
v<Ea, xrefs: 0083B2A8
v<Ea, xrefs: 0083B383
v<Ea, xrefs: 0083C5D9
cannot use operator[] with a string argument with , xrefs: 0083CABD, 0083CAFB, 0083CBAD
v<Ea, xrefs: 0083B093
v<Ea, xrefs: 0083BFBF
v<Ea, xrefs: 0083C011
v<Ea, xrefs: 0083C58D
v<Ea, xrefs: 0083B255
v<Ea, xrefs: 0083B19F
v<Ea, xrefs: 0083BB18
v<Ea, xrefs: 0083C0EE
v<Ea, xrefs: 0083B50C
v<Ea, xrefs: 0083BDF4
v<Ea, xrefs: 0083C7F6
v<Ea, xrefs: 0083B7A8
v<Ea, xrefs: 0083C842
v<Ea, xrefs: 0083B558
v<Ea, xrefs: 0083B14D
v<Ea, xrefs: 0083B75C
cannot use push_back() with , xrefs: 0083C996, 0083CB4B
v<Ea, xrefs: 0083C34A
v<Ea, xrefs: 0083B337
v<Ea, xrefs: 0083BA19

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 1311570089-1931402353
Opcode ID: d56ec6f73a6fc13046d7fec11e1929462feaa19688bf5f89028df46de1e4318f
Instruction ID: 0f46d87236823b1e4c63122a7d286c0a42bd63f4b20d94228c685326de303bce
Opcode Fuzzy Hash: d56ec6f73a6fc13046d7fec11e1929462feaa19688bf5f89028df46de1e4318f
Instruction Fuzzy Hash: 8C0302B0D052688BDB25CF28C895BEDBBB4BF59304F1082D9D849B7241EB706B85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00883B20 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00883F97
std::_Throw_Cpp_error.LIBCPMT ref: 00883FA8

Strings

\*.*, xrefs: 00883BE4

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID: \*.*
API String ID: 2134207285-1173974218
Opcode ID: 741cfcc26fee64edf99d5643ac44bebe6cc4d96010def741d4867c5f2e57ceb5
Instruction ID: 980c9103e518fdf037a98cbd3983ce0db2db96443121d08122e1e6f86c580e89
Opcode Fuzzy Hash: 741cfcc26fee64edf99d5643ac44bebe6cc4d96010def741d4867c5f2e57ceb5
Instruction Fuzzy Hash: 44D1D070D00248DFDB10EFA8C948BEDBBB1FF55314F204259E459BB292DB745A89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0087C3E0 Relevance: 13.1, APIs: 5, Strings: 2, Instructions: 876
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0087C44A
CreateDirectoryA.KERNEL32(?,00000000), ref: 0087C6D9

Part of subcall function 00884050: GetFileAttributesA.KERNELBASE ref: 008840AC
Part of subcall function 00884050: GetLastError.KERNEL32 ref: 008840B7

CreateDirectoryA.KERNEL32(?,00000000), ref: 0087C8DA
CreateDirectoryA.KERNEL32(?,00000000), ref: 0087CBFA

Part of subcall function 00884050: std::_Throw_Cpp_error.LIBCPMT ref: 008840FF
Part of subcall function 00884050: std::_Throw_Cpp_error.LIBCPMT ref: 00884110

CreateDirectoryA.KERNEL32(?,00000000), ref: 0087D02D

Strings

v<Ea, xrefs: 0087C85E
v<Ea, xrefs: 0087D0F9

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileFolderLastPath
String ID: v<Ea$v<Ea
API String ID: 3108237365-2190929436
Opcode ID: 825dd2c5c0ccf78a915ae6d47e9fcc962528d0c5d84ff90eeef2b1c9e20e3e14
Instruction ID: b085a2eff73d2c44d331215f1fd43941579a143336eaee6d34c8ad1c9b48e055
Opcode Fuzzy Hash: 825dd2c5c0ccf78a915ae6d47e9fcc962528d0c5d84ff90eeef2b1c9e20e3e14
Instruction Fuzzy Hash: 54A2EEB4D0425DCBDB15CFA8C985AEEBBB0BF09300F204199D959B7341E7706A85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00864130 Relevance: 12.8, APIs: 3, Strings: 4, Instructions: 535
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00864401

Part of subcall function 007D2524: __EH_prolog3.LIBCMT ref: 007D2560

std::_Throw_Cpp_error.LIBCPMT ref: 00864412

Part of subcall function 00884870: __fread_nolock.LIBCMT ref: 008849B9

DeleteFileA.KERNELBASE(?), ref: 0086449B

Strings

v<Ea, xrefs: 0086477D
nikto, xrefs: 00864521, 0086453A
v<Ea, xrefs: 00864239
131, xrefs: 008644E5, 008644FE

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$DeleteFileH_prolog3__fread_nolock
String ID: 131$nikto$v<Ea$v<Ea
API String ID: 3880692912-2124456754
Opcode ID: 92674b9793ad300e5f187f318bf378b7b61a21378470c6ba872ba56ce1bb00cd
Instruction ID: ce89147273b3eb32e58ae19d5b846df54c150eaf0364027571a43868e3f859b1
Opcode Fuzzy Hash: 92674b9793ad300e5f187f318bf378b7b61a21378470c6ba872ba56ce1bb00cd
Instruction Fuzzy Hash: BA32CDB0D00248CFCB14DFA8D845BAEBBB1FF49304F248159E815AB392D775AE45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 008633B0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?), ref: 008634EF
FindNextFileA.KERNELBASE(00000000,?), ref: 008637EF
GetLastError.KERNEL32 ref: 008637FD
FindClose.KERNEL32(00000000), ref: 0086380D

Strings

v<Ea, xrefs: 008635E6
v<Ea, xrefs: 00863494
v<Ea, xrefs: 008635A0

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID: v<Ea$v<Ea$v<Ea
API String ID: 819619735-1164314080
Opcode ID: 79820468cfff0dba8edc7c0b872433e356a88339a4cb019e3bd0fde65858cf27
Instruction ID: 2c2cea822ea6e7e94191dd371a6840e82f6dc6f60749014a18f0a45ac2bef9a0
Opcode Fuzzy Hash: 79820468cfff0dba8edc7c0b872433e356a88339a4cb019e3bd0fde65858cf27
Instruction Fuzzy Hash: 36D179B0D002888FDB25CFA8C9887EEBBB1FF45314F148299D459BB382D7746A84CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00865940 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0086596A
getaddrinfo.WS2_32(?,?,?,00926328), ref: 008659EC
socket.WS2_32(?,?,?), ref: 00865A0D
connect.WS2_32(00000000,008F6B31,?), ref: 00865A21
closesocket.WS2_32(00000000), ref: 00865A2D
FreeAddrInfoW.WS2_32(?), ref: 00865A3A
WSACleanup.WS2_32 ref: 00865A40
FreeAddrInfoW.WS2_32(?), ref: 00865A55

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: ecc218569aef62485411e6bdfd1a674ec3a7c8638e6906fc0dd25e060113f481
Instruction ID: 8747b845a080f87cca7f6104deb04105cf7f66c3000a82ee309e71d7c18afdee
Opcode Fuzzy Hash: ecc218569aef62485411e6bdfd1a674ec3a7c8638e6906fc0dd25e060113f481
Instruction Fuzzy Hash: F43190725047109BD7209F75DC84A6ABBE9FB84735F11471DF9A9D22A0E730A844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00898080 Relevance: 9.2, Strings: 7, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

automatic extension loading failed: %s, xrefs: 008985AC
BINARY, xrefs: 008982A5, 008982B4, 008982CE, 0089830E, 00898319, 00898331, 00898383, 00898384
sqlite_rename_table, xrefs: 00898464
MATCH, xrefs: 00898488, 00898499, 008984B9, 008984BA, 008984D0
RTRIM, xrefs: 008982E8
NOCASE, xrefs: 008983AA
no such vfs: %s, xrefs: 00898237

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID:
String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
API String ID: 0-1885142750
Opcode ID: 304537c9501a22eba16cd8ed166a7ca85446bef3919e4d269f4cc6113a4d6248
Instruction ID: 10f694cf4e92b8314febe5ab66652d2a5e515149700637de2913e49f7482ef3b
Opcode Fuzzy Hash: 304537c9501a22eba16cd8ed166a7ca85446bef3919e4d269f4cc6113a4d6248
Instruction Fuzzy Hash: EF022470A00702DFEF31AF69DC45B6B77E4FB52304F184428E84ADB292DBB5A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00863EB0 Relevance: 4.7, APIs: 3, Instructions: 206encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00863F07
LocalFree.KERNEL32(?), ref: 00863F36
LocalFree.KERNEL32(?), ref: 00864032

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: 9681ec3ce96e70176ba2396b81fd9d23063634c03fb1b236c3256827a370823d
Instruction ID: 7ee4f444eb93e5f3cfc675e6cd1fe51e33797f22f4744be16af98227ca8e3cc1
Opcode Fuzzy Hash: 9681ec3ce96e70176ba2396b81fd9d23063634c03fb1b236c3256827a370823d
Instruction Fuzzy Hash: 8471C371D00248DBDB00DFA8C8457EDFBB4FB55310F14826AE814B3382EB796A45DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 008DC8D0 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008DCA85
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008DCD87

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 44929161152ec61725dc92b102a84d4f0202cc032cab543c685470209cea879a
Instruction ID: f90ae7db708a12b7b5c8ceeb5421fa10f417285fb87f362a6622f018f35c9507
Opcode Fuzzy Hash: 44929161152ec61725dc92b102a84d4f0202cc032cab543c685470209cea879a
Instruction Fuzzy Hash: BE0279B0604617AFDB18CB69C850B6AB7E1FF89324F04866EE849CB750D774ED54CB82

Uniqueness

Uniqueness Score: -1.00%

Function 007E001D Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16223c9c5debb5c9f643bad3712e7f574c8e858b66cff5b6a3aebcecfed03433
Instruction ID: df353e4d0cad640baf1c97c43cb493ff067a77d0f7e7e285f40a44d62a886514
Opcode Fuzzy Hash: 16223c9c5debb5c9f643bad3712e7f574c8e858b66cff5b6a3aebcecfed03433
Instruction Fuzzy Hash: 87B1E73490268ECBCB248F6AC9596BEB7B5AF0C300F14461ED592AB651C7BC9DC1CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 007F8BA0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59d73a08bba9fce25658a82d2a3aee41a694939f870c85ac318c75fbcdff2e2f
Instruction ID: 2f242cc796e194cbad5dcbe48c021c23dfb6147f4ccaa1aa8f6ff842427e4048
Opcode Fuzzy Hash: 59d73a08bba9fce25658a82d2a3aee41a694939f870c85ac318c75fbcdff2e2f
Instruction Fuzzy Hash: C98105B0E04289CFDB108F58D8947BEBBB4EF1A300F0401A9DA6497783CB399906D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00803650 Relevance: 102.1, APIs: 3, Strings: 54, Instructions: 2365COMMON

Download Yara Rule

APIs

Part of subcall function 00884050: GetFileAttributesA.KERNELBASE ref: 008840AC
Part of subcall function 00884050: GetLastError.KERNEL32 ref: 008840B7

Part of subcall function 00883FC0: CreateDirectoryA.KERNELBASE(?,00000000), ref: 00884005

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00805AD0
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00805DF5

Part of subcall function 00884050: std::_Throw_Cpp_error.LIBCPMT ref: 008840FF
Part of subcall function 00884050: std::_Throw_Cpp_error.LIBCPMT ref: 00884110

CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00805CE6

Strings

v<Ea, xrefs: 008042EA
v<Ea, xrefs: 00805C36
v<Ea, xrefs: 008043DD
v<Ea, xrefs: 0080663D
v<Ea, xrefs: 00804362
v<Ea, xrefs: 00804082
v<Ea, xrefs: 00805674
v<Ea, xrefs: 00805D48
v<Ea, xrefs: 00804500
v<Ea, xrefs: 00804489
v<Ea, xrefs: 0080426F
v<Ea, xrefs: 008064A0
v<Ea, xrefs: 00803C78
v<Ea, xrefs: 0080518D
v<Ea, xrefs: 00804A30
v<Ea, xrefs: 0080400A
v<Ea, xrefs: 008052FF
v<Ea, xrefs: 00805112
v<Ea, xrefs: 00803E4D
v<Ea, xrefs: 00805750
v<Ea, xrefs: 0080501F
v<Ea, xrefs: 00804CA7
v<Ea, xrefs: 00804D19
v<Ea, xrefs: 0080615D
v<Ea, xrefs: 00803741
v<Ea, xrefs: 0080626C
v<Ea, xrefs: 008063DA
v<Ea, xrefs: 008045E4
v<Ea, xrefs: 00805519
v<Ea, xrefs: 0080509A
v<Ea, xrefs: 00803F8F
v<Ea, xrefs: 00803990
v<Ea, xrefs: 00804565
v<Ea, xrefs: 00804DBE
v<Ea, xrefs: 00805F16
v<Ea, xrefs: 0080465B
v<Ea, xrefs: 00803C06
v<Ea, xrefs: 008056EB
v<Ea, xrefs: 00804EE2
v<Ea, xrefs: 008062E7
v<Ea, xrefs: 00805590
v<Ea, xrefs: 00804B38
v<Ea, xrefs: 008040FD
v<Ea, xrefs: 008055F5
v<Ea, xrefs: 008046C0
v<Ea, xrefs: 0080546D
v<Ea, xrefs: 00803A9B
v<Ea, xrefs: 008053F2
v<Ea, xrefs: 00803D23
v<Ea, xrefs: 00806033
v<Ea, xrefs: 0080537A
v<Ea, xrefs: 00805F88
v<Ea, xrefs: 008067E8
v<Ea, xrefs: 0080635F

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID: v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 453214671-409038647
Opcode ID: e02b2c9acb90469d1ba7beb1163bf6020a4f29acd4d52f981ec3d5f6f7837be7
Instruction ID: e01780c34210289d59835c26c43598c7bbc3f3eea0cd1faeb727f15130ca2031
Opcode Fuzzy Hash: e02b2c9acb90469d1ba7beb1163bf6020a4f29acd4d52f981ec3d5f6f7837be7
Instruction Fuzzy Hash: EC53BCB1D15268CFDB65DB24CC98BDDBBB4BB49300F0081EAA449A7292DB742F84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 007FE090 Relevance: 46.3, APIs: 10, Strings: 16, Instructions: 832
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007AB8E0: CreateDirectoryA.KERNELBASE(?,00000000), ref: 007ABA08

CreateDirectoryA.KERNELBASE(?,00000000), ref: 007FE192
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 007FE322
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 007FE415
CreateDirectoryA.KERNEL32(?,00000000), ref: 007FE50B
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 007FE757
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007FE8D5
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 007FEA65
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 007FEB58

Part of subcall function 00884050: GetFileAttributesA.KERNELBASE ref: 008840AC
Part of subcall function 00884050: GetLastError.KERNEL32 ref: 008840B7

CreateDirectoryA.KERNEL32(?,00000000), ref: 007FEC4E
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,-0000004C), ref: 007FEEA6

Part of subcall function 008749B0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,008F80C7,000000FF), ref: 00874A1C
Part of subcall function 008749B0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00874A43

Strings

v<Ea, xrefs: 007FE9C4
v<Ea, xrefs: 007FE120
v<Ea, xrefs: 007FE458
4<Ea, xrefs: 007FECA4
v<Ea, xrefs: 007FE358
v<Ea, xrefs: 007FED12
v<Ea, xrefs: 007FED77
v<Ea, xrefs: 007FEA9B
v<Ea, xrefs: 007FE869
v<Ea, xrefs: 007FEDEC
v<Ea, xrefs: 007FE691
v<Ea, xrefs: 007FE281
v<Ea, xrefs: 007FEB9B
v<Ea, xrefs: 007FE61C
v<Ea, xrefs: 007FE5C3
4<Ea, xrefs: 007FE561

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: CreateDirectory$FolderPath$AttributesErrorFileLast
String ID: 4<Ea$4<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 3066340180-3580313535
Opcode ID: c277fe3d948310359fd7689e97b1e1dc0a8733d7323c8d254fdfc65842f9d2d2
Instruction ID: b943c0713c1b2fbcf2badf6730a4c000aa1a1dfb03df24a6cf60761c4b0dee95
Opcode Fuzzy Hash: c277fe3d948310359fd7689e97b1e1dc0a8733d7323c8d254fdfc65842f9d2d2
Instruction Fuzzy Hash: 029221B1D002ACDBDB25DB68CC99BDDBBB4AB15300F0041E9E449A7292EB741F89DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00864EB0 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000370,0000FFFF,00001006,?,00000008), ref: 00864F56
recv.WS2_32(?,00000004,00000002), ref: 00864F71
WSAGetLastError.WS2_32 ref: 00864F75
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 00864FF3
recv.WS2_32(00000000,0000000C,00000008), ref: 00865014
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 008650B0
recv.WS2_32(00000000,?,00000008), ref: 008650CB

Part of subcall function 00865940: WSAStartup.WS2_32 ref: 0086596A
Part of subcall function 00865940: getaddrinfo.WS2_32(?,?,?,00926328), ref: 008659EC
Part of subcall function 00865940: socket.WS2_32(?,?,?), ref: 00865A0D
Part of subcall function 00865940: connect.WS2_32(00000000,008F6B31,?), ref: 00865A21
Part of subcall function 00865940: closesocket.WS2_32(00000000), ref: 00865A2D
Part of subcall function 00865940: FreeAddrInfoW.WS2_32(?), ref: 00865A3A
Part of subcall function 00865940: WSACleanup.WS2_32 ref: 00865A40

recv.WS2_32(?,00000004,00000008), ref: 008651D3
__Xtime_get_ticks.LIBCPMT ref: 008651DA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008651E8
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 00865261
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 00865269

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: d18f363556602ccb562feb157e56f3ff22b8b3f480a9cf6a69c58ba9b4e76125
Instruction ID: 17e48625901af253e4738a2fa9c15f884dc1222d9a80350eca6fe19a53fd2ecc
Opcode Fuzzy Hash: d18f363556602ccb562feb157e56f3ff22b8b3f480a9cf6a69c58ba9b4e76125
Instruction Fuzzy Hash: 2AB1CBB0D04308DFEB25DFA8DC89BADBBB1FB45310F200219E454AB2E2D7745984DB82

Uniqueness

Uniqueness Score: -1.00%

Function 00881AD0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 291
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegGetValueA.KERNELBASE(80000002,?,?,0001FFFF,?,?,00000104), ref: 00881E20
GetComputerNameExA.KERNELBASE(00000002,?,00000104), ref: 00881E8C
LsaOpenPolicy.ADVAPI32(00000000,00924684,00000001,?), ref: 00881EE5
LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 00881EF8
LsaFreeMemory.ADVAPI32(?), ref: 00881F26
LsaClose.ADVAPI32(?), ref: 00881F2F

Strings

v<Ea, xrefs: 00881CD7
%wZ, xrefs: 00881F15

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ$v<Ea
API String ID: 762890658-2964453009
Opcode ID: cfb181350c6d559db5897f8be3ac1439abc2d91aa2d4be65fe7b179cad12c191
Instruction ID: f9a504a080530569e4f22d12a0eb4882e844394a3d414a04ae3df4b247cac9b0
Opcode Fuzzy Hash: cfb181350c6d559db5897f8be3ac1439abc2d91aa2d4be65fe7b179cad12c191
Instruction Fuzzy Hash: AFE1E1B4D0425ACBDB14CF98D985BEEBBB4BF08310F204199EA49B7351DB705A85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 007A9280 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll), ref: 007A96A6
GetProcAddress.KERNEL32(00000000,?), ref: 007A96B4
WSASend.WS2_32(?,?,00000001,?,00000000,00000000,00000000), ref: 007A96C9

Strings

v<Ea, xrefs: 007A962C
Ws2_32.dll, xrefs: 007A969A
v<Ea, xrefs: 007A9660

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll$v<Ea$v<Ea
API String ID: 2819740048-996692458
Opcode ID: cee7d1606f87823a61e1291008750d296a143c035910f74caad7068cf7e428cc
Instruction ID: 56eed64a6ee16060143f03704a615fb2570d82a3abf3b850b20b29d041198e1c
Opcode Fuzzy Hash: cee7d1606f87823a61e1291008750d296a143c035910f74caad7068cf7e428cc
Instruction Fuzzy Hash: 0202F270D04298DFDF25CFA8C8907ADBBB0FF96310F244289E4456B686D7781986CF92

Uniqueness

Uniqueness Score: -1.00%

Function 007E8900 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d69dc29ea415757c353415412fcd8e93fa814cc4867dc48cef0fa43eff3887
Instruction ID: 047e3fe10cbf1b5c506fde48b8fb0e5b2ca9fa4070435ddd8433ee56962ae342
Opcode Fuzzy Hash: 02d69dc29ea415757c353415412fcd8e93fa814cc4867dc48cef0fa43eff3887
Instruction Fuzzy Hash: 76B11BB0A06284EFDB51DF9AC845BBD7BB1BF4D310F144198E408AB392DB789D41CB62

Uniqueness

Uniqueness Score: -1.00%

Function 008652A0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 399COMMON

Download Yara Rule

Strings

v<Ea, xrefs: 00865451
v<Ea, xrefs: 0086552A
v<Ea, xrefs: 008655B5

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID:
String ID: v<Ea$v<Ea$v<Ea
API String ID: 0-1164314080
Opcode ID: a61a5725223217842ac1283665a30a2da6e7d891d0891103bcb6524dd2bbf577
Instruction ID: 9544d6e72d3e475b763aaaaeeeb0c2d73594488c38ea8400e1eeaadb7b882f9c
Opcode Fuzzy Hash: a61a5725223217842ac1283665a30a2da6e7d891d0891103bcb6524dd2bbf577
Instruction Fuzzy Hash: 07020F70D04288DFDB14DFA8C9497DDBBB0EB54304F1481A9D805AB386D7B95E88DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00873B40 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 278fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 00873DD0

Part of subcall function 00873F50: GetLastError.KERNEL32(?,00000000), ref: 00873F83
Part of subcall function 00873F50: 6E387CF0.RSTRTMGR(?,00000000,?), ref: 00874000

std::_Throw_Cpp_error.LIBCPMT ref: 00873F34
std::_Throw_Cpp_error.LIBCPMT ref: 00873F45

Strings

v<Ea, xrefs: 00873D17

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CopyE387ErrorFileLast
String ID: v<Ea
API String ID: 3434067823-4124759590
Opcode ID: 762700ec1ee001ac31815dad15024421eba9f86cd99feb2ee1445267072ced4b
Instruction ID: ea06a15dacfe13b7808e99cd5b4d56789bba77f53c535582acf09947393c79e0
Opcode Fuzzy Hash: 762700ec1ee001ac31815dad15024421eba9f86cd99feb2ee1445267072ced4b
Instruction Fuzzy Hash: 37D15AB1D00249DBDB14DFA8C9457EEBBB0FF55304F148259D818B7382EB745A89CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00831680 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 264registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000001,?,?,?,?,?,?,?,?,00000000), ref: 008318A9
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,006D869C,?,?,?,?,?,?,?,00000000), ref: 008318CC
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00000000), ref: 008318D7

Strings

v<Ea, xrefs: 008317B6

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: v<Ea
API String ID: 3677997916-4124759590
Opcode ID: 48bd9aa6017fb052fe63f92833623139f4114397db0521ebd13e3e8584b4d40a
Instruction ID: 958db49eb0fdcc3ebd58dc6863d7d38a92f37905c7e59b6e873a02bca9957850
Opcode Fuzzy Hash: 48bd9aa6017fb052fe63f92833623139f4114397db0521ebd13e3e8584b4d40a
Instruction Fuzzy Hash: 9EC125B0D05219DBDB14DFA8C986BAEBBB0FF48710F204259E915B7381D7745A84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00884050 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE ref: 008840AC
GetLastError.KERNEL32 ref: 008840B7
std::_Throw_Cpp_error.LIBCPMT ref: 008840FF
std::_Throw_Cpp_error.LIBCPMT ref: 00884110

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: 7c5313bed43d82956b9f8ce524b5e3b93bedc1e528144fe2b350fc6635bfa1ca
Instruction ID: ba9e06b1d9672aae4bb7b6d59320cdbc1f0a7def814b95c8ff7032d38c081f61
Opcode Fuzzy Hash: 7c5313bed43d82956b9f8ce524b5e3b93bedc1e528144fe2b350fc6635bfa1ca
Instruction Fuzzy Hash: E01197B2400A02DACB347F38AC08B6A7764FB02734F240325E535DBBD2EB23485AC752

Uniqueness

Uniqueness Score: -1.00%

Function 00882BA0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 350COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00882C3F
GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00882F4B

Strings

v<Ea, xrefs: 00882FC6

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: DirectoryInformationVolumeWindows
String ID: v<Ea
API String ID: 3487004747-4124759590
Opcode ID: 1599c75c7e2488a422b92176c4b27aea51738318ad4de3fe306d02ec7f2f8879
Instruction ID: 9b849581b104951fd667d7fb6b0150c7454749678b9810818b70fa2e50cd9d4e
Opcode Fuzzy Hash: 1599c75c7e2488a422b92176c4b27aea51738318ad4de3fe306d02ec7f2f8879
Instruction Fuzzy Hash: 64F136B0D10249DBDB15CFA8C985BEEFBB1BF09304F244259E544BB341E7756A84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 007EB9C2 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,007DD2A1,?), ref: 007EB9CA
GetLastError.KERNEL32(?,007DD2A1,?), ref: 007EB9D4
__dosmaperr.LIBCMT ref: 007EB9DB

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 78060b80a62ac5fcbad1f2b28a2bd1d8f959c21b11eceda9286d54d2ea50a2b1
Instruction ID: 84ac26553a55dc42dad6d31a389002a139c07c619a8730b106bf621b0ca1ab2a
Opcode Fuzzy Hash: 78060b80a62ac5fcbad1f2b28a2bd1d8f959c21b11eceda9286d54d2ea50a2b1
Instruction Fuzzy Hash: A7D01272119648B78B042BF7BC0DD273F5DABC43787280651F52DC51A1DF36E891D551

Uniqueness

Uniqueness Score: -1.00%

Function 008849F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00884B5C

Strings

v<Ea, xrefs: 00884AB2

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: __fread_nolock
String ID: v<Ea
API String ID: 2638373210-4124759590
Opcode ID: b216fce3b90687de98fabf1d0a4e59a898d25801ae63d56324934daca1151023
Instruction ID: 5dfad0d4ca7d30c7e3de1ba1e61c85dc686dc2e3b038e101cc502a71a3e9175f
Opcode Fuzzy Hash: b216fce3b90687de98fabf1d0a4e59a898d25801ae63d56324934daca1151023
Instruction Fuzzy Hash: 345159B1D00249DBDB20DF98C946BAEBBB4EF44714F10421DE851AB381D7B56A44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00884870 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 008849B9

Strings

v<Ea, xrefs: 00884912

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: __fread_nolock
String ID: v<Ea
API String ID: 2638373210-4124759590
Opcode ID: 38a7b4343b5cc495c2f319f13505a3d3c78f9cd72cac239a4555ede236685bf8
Instruction ID: 8af0d15c6bd5020f4485d8d5750ebd4fb542066491eebaa095e55a812c3a4331
Opcode Fuzzy Hash: 38a7b4343b5cc495c2f319f13505a3d3c78f9cd72cac239a4555ede236685bf8
Instruction Fuzzy Hash: 5A414AB1D00249DBDB10DF98D886BAEBBB4FF49704F104159E810BB382E779A901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008739A0 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00873B1A
std::_Throw_Cpp_error.LIBCPMT ref: 00873B2B

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 437624800fedf4e135004a7fa095360d9b0fc106ea02030a496cd95a50a98811
Instruction ID: a2916b071a6ae673ad3870a0dfc90a0031b664c2c999959a25d1dec6ece2278f
Opcode Fuzzy Hash: 437624800fedf4e135004a7fa095360d9b0fc106ea02030a496cd95a50a98811
Instruction Fuzzy Hash: 58412571E04641CBC720DF2CD84272EB7B0FB80314F184329E855A7786E775EA06D792

Uniqueness

Uniqueness Score: -1.00%

Function 007E8DEF Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,007E8CD6,00000000,CF830579,00917178,0000000C,007E8D92,007DD06D,?), ref: 007E8E45
GetLastError.KERNEL32(?,007E8CD6,00000000,CF830579,00917178,0000000C,007E8D92,007DD06D,?), ref: 007E8E4F

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: ba9394ba22be3e53b91392237a0dcf7ef746737f538ee74c43f0fafeb0ef2f08
Instruction ID: eff5c641a8fa0d95b459240e7ce49dda7dec80ca53fa5f71e0e417c8afda6181
Opcode Fuzzy Hash: ba9394ba22be3e53b91392237a0dcf7ef746737f538ee74c43f0fafeb0ef2f08
Instruction Fuzzy Hash: C7114C326071D096C6A66276AC49B7D27898B8D734F2A0A49F81CDB1C2DF39AC818193

Uniqueness

Uniqueness Score: -1.00%

Function 007E250C Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00916E30,007D2B4E,00000002,007D2B4E,00000000,?,?,?,007E2616,00000000,?,007D2B4E,00000002,00916E30), ref: 007E2548
GetLastError.KERNEL32(007D2B4E,?,?,?,007E2616,00000000,?,007D2B4E,00000002,00916E30,00000000,007D2B4E,00000000,00916E30,0000000C,007DD60E), ref: 007E2555

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: bf9117061f70f60fbec3f8f723406ba0135644ba9978a1fc33ab11dfc02091e5
Instruction ID: d406ef09e63db1e653773576ad1ecd9ea437f856546591c7b360120d4fa461a9
Opcode Fuzzy Hash: bf9117061f70f60fbec3f8f723406ba0135644ba9978a1fc33ab11dfc02091e5
Instruction Fuzzy Hash: 47012633615185AFCF09CF6ADC15CAE3B2DEB88330B240248F8019B291EA75ED52CB90

Uniqueness

Uniqueness Score: -1.00%

Function 007EB00C Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,007E1C9E,00000001,?,?,007D4B55,00000000,?,0080A937,18EC83FF,?,007A3522,?,?), ref: 007EB022
GetLastError.KERNEL32(00000000,?,007E1C9E,00000001,?,?,007D4B55,00000000,?,0080A937,18EC83FF,?,007A3522,?,?), ref: 007EB02D

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: a7bf66127036e026ee712708d52b5e027df76fbb384035e385bdb43855718525
Instruction ID: 63d104d6483dc90eba78517b42931e646b65e28a8d45ace9b7c556b2d4484d74
Opcode Fuzzy Hash: a7bf66127036e026ee712708d52b5e027df76fbb384035e385bdb43855718525
Instruction Fuzzy Hash: 15E08C32101244EBCB212BB6EC0DFAA3A5ABB48365F044020F60C96170DF3D9850C784

Uniqueness

Uniqueness Score: -1.00%

Function 007B5350 Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007B546E

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 247470c331a614f0c4de326aabf7c461ba678b6a7defb3a7108c8406dc44adfe
Instruction ID: 14853a35498c0704c901a69da8cc81d7ce203eaf1ab53a987587d9d3699c1215
Opcode Fuzzy Hash: 247470c331a614f0c4de326aabf7c461ba678b6a7defb3a7108c8406dc44adfe
Instruction Fuzzy Hash: 21617AB1A01615DFCB10CF59C984B9ABBF5FF48710F24816EE4199B391C779EA01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 007D8DF2 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca036a2261ff6000a1aed8eb9ac9c6932f0186910c3de27deff8ec8666f63131
Instruction ID: a9a0c669541eb09d2887fa8b4322f5ca383280e95396be8b6b2c1dddb3a316c9
Opcode Fuzzy Hash: ca036a2261ff6000a1aed8eb9ac9c6932f0186910c3de27deff8ec8666f63131
Instruction Fuzzy Hash: FA51C670A00204EFDF54DF58C885AAD7BB2EF49324F29815AF849AB352D735DD41CB92

Uniqueness

Uniqueness Score: -1.00%

Function 007A3130 Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007A32B8

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 42849b72ea8d03fc776094d2ae746cd05c8102cdbbaf42b32d92640830797b38
Instruction ID: e7f109a0a522ae75a4c4969a731eed67f50426827eb89ee6b2a57bbf1aaea0f9
Opcode Fuzzy Hash: 42849b72ea8d03fc776094d2ae746cd05c8102cdbbaf42b32d92640830797b38
Instruction Fuzzy Hash: AA41C4B1A00514DFCB04DF6CC985A6EBBB5EB89350F14436AF815DB385D738DE018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 007C9E20 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007C9F7B

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 5227e5300e16c0fd4b7b03a98ceaf71633bb9958b9dc448d81191bd8685b0dd2
Instruction ID: 699d87cb47f5b9762da7adb65511283591145aeb3c7f49d50daaf1d91284a20b
Opcode Fuzzy Hash: 5227e5300e16c0fd4b7b03a98ceaf71633bb9958b9dc448d81191bd8685b0dd2
Instruction Fuzzy Hash: 3341B272A00115DFCB04DF68C849AAEBBB9EB99350F14426EE915E7385D738DE018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 007A6870 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 007A6908

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: ___std_fs_directory_iterator_open@12
String ID:
API String ID: 29801545-0
Opcode ID: 891e69dd3eff687b8964aa0fa00620d2fc0cc89e1415068b77e8d59ef2433ba3
Instruction ID: a2cadb672f99ac764f297e85e7b43f0dfa4408a08d7a34b29ae0bbb520d00868
Opcode Fuzzy Hash: 891e69dd3eff687b8964aa0fa00620d2fc0cc89e1415068b77e8d59ef2433ba3
Instruction Fuzzy Hash: 71216F76E00619EBCB14DF48D855BAEB7B8FB85720F04066AE92963780DB396D05C790

Uniqueness

Uniqueness Score: -1.00%

Function 008830B0 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(008FA560,00000000,00000000), ref: 008830F7

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: 947cff12d33b7858f6893a413022120a602fc5f2de22cfba05145ec03f557ac3
Instruction ID: 78e9bdb647dd6b3dda3ce214cc8f36bfd5f8602bc0c6a2d9a6f21068abf82aba
Opcode Fuzzy Hash: 947cff12d33b7858f6893a413022120a602fc5f2de22cfba05145ec03f557ac3
Instruction Fuzzy Hash: FD11ACB0D047489BD7209F28D90A717BBA4FB04B24F10471DE865973C1E7B96A5887D2

Uniqueness

Uniqueness Score: -1.00%

Function 007A32D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007A331F

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6ec4655adc9d8c581670169791bfeb4c3c4bb59604ad5d7a34e59d92e7cd2194
Instruction ID: 8e347fc77963783eab831398f7b4561f7e0a3441648a8b9333c489ab43d5df45
Opcode Fuzzy Hash: 6ec4655adc9d8c581670169791bfeb4c3c4bb59604ad5d7a34e59d92e7cd2194
Instruction Fuzzy Hash: A3F0B472100104DBCF146F64D41A8E9B3F8EF653A17100A7BF88DC7612EB2EDA418791

Uniqueness

Uniqueness Score: -1.00%

Function 007EB086 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?), ref: 007EB0B8

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8ff3445ee8e629794c9330360283e5f8b0218daac3a85bb2da0d5f65dfdccf0f
Instruction ID: ae5601da76b995fe11568ff602b32e0468845a7b654ac64d7553ecd3aeb7c435
Opcode Fuzzy Hash: 8ff3445ee8e629794c9330360283e5f8b0218daac3a85bb2da0d5f65dfdccf0f
Instruction Fuzzy Hash: C8E030311135D0ABE63127779C05B6B2E49AF493B0B150221ED65970E1DF2DEC0095E1

Uniqueness

Uniqueness Score: -1.00%

Function 007A6840 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 007A6853

Part of subcall function 007D1F6B: FindNextFileW.KERNELBASE(?,?,?,007A6858,?,?,?,?,007A691A,?,?,?,00000000,?,?), ref: 007D1F74

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: fff74abef5ad4ab776fc00913f1374bcbb9169b1c9b3633ac3d7d852fcb85055
Instruction ID: 340b454187d14ab2f51b12bc5edc22f143964d07715eaae63883424afb606d75
Opcode Fuzzy Hash: fff74abef5ad4ab776fc00913f1374bcbb9169b1c9b3633ac3d7d852fcb85055
Instruction Fuzzy Hash: 11D0C926705920611E25662B39099BF469E4ED7BB4B89026AF94AD3242EE0C8C0B40A6

Uniqueness

Uniqueness Score: -1.00%

Function 007E66C5 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007E66CC

Memory Dump Source

Source File: 00000000.00000002.2323661294.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2323643354.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323758499.00000000008FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323776358.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323799821.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323817101.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.000000000092D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323834373.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323961256.000000000093C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2323983621.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000942000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.0000000000947000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324010034.000000000094A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B05000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324081576.0000000000B41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324869799.0000000000CA0000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: a9306003e970101730b418f2c91dc82bd0aea721bb9e8afae98ccf3f0939bc66
Instruction ID: 8ea152f531c7d5dc4e6e495d4057f8ae535502c61cf3c0b6e464e786636292a0
Opcode Fuzzy Hash: a9306003e970101730b418f2c91dc82bd0aea721bb9e8afae98ccf3f0939bc66
Instruction Fuzzy Hash: 92E09AB2D0020EDADF00EFE4D546BEFB7B8AB08310F504067A255E6181EB7897448BA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_c7733ed6211f554fcfc5ee43638ebe35de626d7b_d1a40e08_31f9afae-1cd9-4f56-a64f-1215315a588c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_58fad3732ffecccafd3e19178e69f9a63423f5_394a0634_de233a83-76a7-4005-9f01-53431517d840\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE18D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE298.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2C8.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0C0.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF18C.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1AC.tmp.xml

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\1YMX7UxRgh318S1TWXmjgUx.zip

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre