Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe
Analysis ID:	1434901
MD5:	8a5ac55fce35d8a033ded9e56940152a
SHA1:	704b32b4695e9f591147e0a1b055fb15d66fc50d
SHA256:	753c54477705a387e4a0dee1f54529fa309172175cf22baea4dae67b0005c1dd
Tags:	exe
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Hides threads from debuggers

PE file has nameless sections

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe (PID: 7412 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe" MD5: 8A5AC55FCE35D8A033DED9E56940152A)

schtasks.exe (PID: 7464 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7516 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MPGPH131.exe (PID: 7576 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 8A5AC55FCE35D8A033DED9E56940152A)

MPGPH131.exe (PID: 7588 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 8A5AC55FCE35D8A033DED9E56940152A)

RageMP131.exe (PID: 7652 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 8A5AC55FCE35D8A033DED9E56940152A)

RageMP131.exe (PID: 8032 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 8A5AC55FCE35D8A033DED9E56940152A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\QEGVANwj0k6bYEp2nEbzchm.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.3569384353.00000000017A7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000B.00000003.3434983200.0000000001897000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000B.00000002.3570549317.0000000001898000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe PID: 7412	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7576	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7588	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7652	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 8032	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 8032	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, ProcessId: 7412, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/01/24-21:28:21.747237
SID:	2046269
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/01/24-21:28:07.401095
SID:	2046269
Source Port:	49740
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-21:26:25.313213
SID:	2046267
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-21:25:22.952144
SID:	2046266
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/01/24-21:28:21.731238
SID:	2046269
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/01/24-21:25:22.787637
SID:	2049060
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-21:25:33.353823
SID:	2046266
Source Port:	58709
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-21:26:25.907179
SID:	2046267
Source Port:	58709
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-21:25:27.381179
SID:	2046266
Source Port:	58709
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-21:25:27.359968
SID:	2046266
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-21:26:26.205307
SID:	2046267
Source Port:	58709
Destination Port:	49740
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-21:25:43.854924
SID:	2046266
Source Port:	58709
Destination Port:	49740
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-21:26:25.562531
SID:	2046267
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-21:26:25.578399
SID:	2046267
Source Port:	58709
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/01/24-21:28:21.838617
SID:	2046269
Source Port:	49733
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/01/24-21:28:21.779239
SID:	2046269
Source Port:	49732
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://193.233.132.167/cost/lenin.exe	URL Reputation: Label: malware
Source: http://193.233.132.167/cost/go.exe	Avira URL Cloud: Label: malware
Source: http://193.233.132.167/cost/lenin.exe.exe	Avira URL Cloud: Label: phishing
Source: http://193.233.132.167/cost/go.exe.1	Avira URL Cloud: Label: phishing
Source: http://147.45.47.102:57893/hera/amadka.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Avira: detection malicious, Label: HEUR/AGEN.1306558
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Avira: detection malicious, Label: HEUR/AGEN.1306558

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

ReversingLabs: Detection: 36%

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49751 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E01F8C FindClose,FindFirstFileExW,GetLastError,	0_2_00E01F8C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0126AD7B FindFirstFileA,	5_2_0126AD7B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00981F8C FindClose,FindFirstFileExW,GetLastError,	5_2_00981F8C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0126AD7B FindFirstFileA,	6_2_0126AD7B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00981F8C FindClose,FindFirstFileExW,GetLastError,	6_2_00981F8C
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00621F8C FindClose,FindFirstFileExW,GetLastError,	7_2_00621F8C

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49730 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49730 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49731 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49732 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49733
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49733 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49740
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49740 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49733
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49740

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 147.45.47.93:58709

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 147.45.47.93 147.45.47.93
Source: Joe Sandbox View	IP Address: 104.26.5.15 104.26.5.15

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Code function: 0_2_00E95940 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,FreeAddrInfoW,WSACleanup,FreeAddrInfoW,

0_2_00E95940

Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com

Source: RageMP131.exe, 00000007.00000002.3570083740.0000000001937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera
Source: RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.ex
Source: RageMP131.exe, 00000007.00000002.3570083740.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: RageMP131.exe, 00000007.00000002.3570083740.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe
Source: RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe.1
Source: RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe
Source: RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3566559066.00000000005F1000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000003.2484291481.0000000000997000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3568341169.000000000099A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3570587845.00000000017C6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2578480549.00000000017C3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819405097.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819215520.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3569205726.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876833828.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2877100726.0000000001968000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=149.18.24.96
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000003.2484291481.0000000000997000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3568341169.000000000099A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=149.18.24.96L
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=149.18.24.96omdW
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.000000000095E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3569605772.000000000176B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819405097.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819215520.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3569205726.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876833828.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570083740.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.00000000017A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=149.18.24.96
Source: RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RageMP131.exe, 00000007.00000002.3569378412.00000000018DF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3569378412.000000000189E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2877100726.0000000001968000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570083740.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3401026967.0000000001889000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3400228517.0000000001889000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.0000000001817000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.0000000001825000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399409021.0000000001889000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3402253621.000000000188A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2876513401.0000000001889000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937775107.0000000001889000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: MPGPH131.exe, 00000006.00000002.3569205726.00000000019D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/:Z
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.0000000000951000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3569605772.0000000001780000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819215520.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3569205726.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876833828.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570083740.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.0000000001825000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: RageMP131.exe, 0000000B.00000002.3569384353.0000000001817000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ch
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3566559066.00000000005F1000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.00000000008FB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/j
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/u
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.000000000090A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3569605772.000000000173A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3569605772.0000000001780000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3569205726.00000000019E0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819215520.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3569205726.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3569378412.00000000018DA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876833828.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570083740.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.0000000001825000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.00000000017E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/149.18.24.96
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.0000000000951000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/149.18.24.96;74
Source: RageMP131.exe, 0000000B.00000002.3569384353.00000000017E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/149.18.24.96J
Source: MPGPH131.exe, 00000006.00000002.3569205726.00000000019E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/149.18.24.96R
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.0000000000951000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3569605772.0000000001780000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819215520.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3569205726.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876833828.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570083740.0000000001920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/149.18.24.96
Source: RageMP131.exe, 0000000B.00000002.3569384353.00000000017A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/149.18.24.96o
Source: RageMP131.exe, 0000000B.00000003.3401026967.0000000001889000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.microsoft.
Source: RageMP131.exe, 0000000B.00000003.3401026967.0000000001889000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.microsoft..
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://support.mozilla.org
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 6IHWoe8lbZ9DHistory.11.dr, D4_tggVjtkMeHistory.11.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 6IHWoe8lbZ9DHistory.11.dr, D4_tggVjtkMeHistory.11.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 6IHWoe8lbZ9DHistory.11.dr, D4_tggVjtkMeHistory.11.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 6IHWoe8lbZ9DHistory.11.dr, D4_tggVjtkMeHistory.11.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: RageMP131.exe, 0000000B.00000002.3570549317.0000000001898000.00000004.00000020.00020000.00000000.sdmp, QEGVANwj0k6bYEp2nEbzchm.zip.11.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTAT
Source: MPGPH131.exe, 00000006.00000002.3569205726.00000000019A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTKue
Source: MPGPH131.exe, 00000005.00000002.3570587845.00000000017C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro
Source: MPGPH131.exe, 00000006.00000002.3569205726.0000000001A32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/riseproAD
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399409021.0000000001889000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3402253621.000000000188A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2876552455.0000000001896000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2876513401.0000000001889000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3403590192.0000000001912000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3434983200.0000000001897000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3570549317.0000000001898000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937775107.0000000001889000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.11.dr	String found in binary or memory: https://t.me/risepro_bot
Source: RageMP131.exe, 00000007.00000003.2876833828.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2877100726.0000000001968000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot)f
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot.961740
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot/M1
Source: MPGPH131.exe, 00000005.00000002.3570587845.00000000017C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot:g
Source: RageMP131.exe, 00000007.00000003.2876833828.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2877100726.0000000001968000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlaterH
Source: RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MPGPH131.exe, RageMP131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://www.mozilla.org
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: RageMP131.exe, 0000000B.00000003.2937775107.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3401026967.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399409021.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3402253621.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2938107196.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3434983200.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2938399876.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.11.dr, 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/dat
Source: RageMP131.exe, 0000000B.00000003.2937775107.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3401026967.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399409021.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3402253621.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2938107196.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3434983200.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2938399876.00000000018E5000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.11.dr, 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49751 version: TLS 1.2

System Summary

PE file has nameless sections

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E07190	0_2_00E07190
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E0C950	0_2_00E0C950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E0A918	0_2_00E0A918
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E1DA74	0_2_00E1DA74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E28BA0	0_2_00E28BA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00EC0350	0_2_00EC0350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E1035F	0_2_00E1035F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E225FE	0_2_00E225FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00DFF570	0_2_00DFF570
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00EBCFC0	0_2_00EBCFC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E247AD	0_2_00E247AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF70B2E	0_2_7EF70B2E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF70000	0_2_7EF70000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00987190	5_2_00987190
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0098A918	5_2_0098A918
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0098C950	5_2_0098C950
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0099DA74	5_2_0099DA74
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_009A8BA0	5_2_009A8BA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0099035F	5_2_0099035F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00A40350	5_2_00A40350
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0097F570	5_2_0097F570
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_009A47AD	5_2_009A47AD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00A3CFC0	5_2_00A3CFC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_7F810B2E	5_2_7F810B2E
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_7F810000	5_2_7F810000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00987190	6_2_00987190
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0098A918	6_2_0098A918
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0098C950	6_2_0098C950
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0099DA74	6_2_0099DA74
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_009A8BA0	6_2_009A8BA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0099035F	6_2_0099035F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00A40350	6_2_00A40350
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0097F570	6_2_0097F570
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_009A47AD	6_2_009A47AD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00A3CFC0	6_2_00A3CFC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_7F690B2E	6_2_7F690B2E
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_7F690000	6_2_7F690000
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_0062C950	7_2_0062C950
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_0062A918	7_2_0062A918
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00627190	7_2_00627190
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_0063DA74	7_2_0063DA74
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_0063035F	7_2_0063035F
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_006E0350	7_2_006E0350
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00648BA0	7_2_00648BA0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_0061F570	7_2_0061F570
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_006DCFC0	7_2_006DCFC0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_006447AD	7_2_006447AD
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_7F480B2E	7_2_7F480B2E
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_7F480000	7_2_7F480000

Source: Joe Sandbox View	Dropped File: C:\ProgramData\MPGPH131\MPGPH131.exe 753C54477705A387E4A0DEE1F54529FA309172175CF22BAEA4DAE67B0005C1DD
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe 753C54477705A387E4A0DEE1F54529FA309172175CF22BAEA4DAE67B0005C1DD

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: String function: 00984370 appears 48 times

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: Section: ZLIB complexity 0.9997519048380221
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: Section: ZLIB complexity 0.9934290213178295
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: Section: ZLIB complexity 0.99267578125
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: Section: ZLIB complexity 1.0006510416666667
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997519048380221
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9934290213178295
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99267578125
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0006510416666667
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997519048380221
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9934290213178295
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99267578125
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0006510416666667

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/26@2/3

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7524:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3566559066.00000000005F1000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3566559066.00000000005F1000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: zMQYNC4o8CfOLogin Data For Account.11.dr, VuhoTc5LnxleLogin Data.11.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

ReversingLabs: Detection: 36%

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: RageMP131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Static file information: File size 3181568 > 1048576

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x221c00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Unpacked PE file: 0.2.SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe.dd0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 5.2.MPGPH131.exe.950000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 6.2.MPGPH131.exe.950000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 7.2.RageMP131.exe.5f0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 11.2.RageMP131.exe.5f0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Code function: 0_2_00E9C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_00E9C630

Source: initial sample

Static PE information: section where entry point is pointing to: .data

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E03F49 push ecx; ret	0_2_00E03F5C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF70EF0 push 7EF70002h; ret	0_2_7EF70EFF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF71AF0 push 7EF70002h; ret	0_2_7EF71AFF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF726F0 push 7EF70002h; ret	0_2_7EF726FF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF712E0 push 7EF70002h; ret	0_2_7EF712EF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF71EE0 push 7EF70002h; ret	0_2_7EF71EEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF72AE0 push 7EF70002h; ret	0_2_7EF72AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF716D0 push 7EF70002h; ret	0_2_7EF716DF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF722D0 push 7EF70002h; ret	0_2_7EF722DF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF70EC0 push 7EF70002h; ret	0_2_7EF70ECF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF71AC0 push 7EF70002h; ret	0_2_7EF71ACF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF726C0 push 7EF70002h; ret	0_2_7EF726CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF712B0 push 7EF70002h; ret	0_2_7EF712BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF71EB0 push 7EF70002h; ret	0_2_7EF71EBF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF72AB0 push 7EF70002h; ret	0_2_7EF72ABF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF716A0 push 7EF70002h; ret	0_2_7EF716AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF722A0 push 7EF70002h; ret	0_2_7EF722AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF70E90 push 7EF70002h; ret	0_2_7EF70E9F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF71A90 push 7EF70002h; ret	0_2_7EF71A9F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF72690 push 7EF70002h; ret	0_2_7EF7269F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF71280 push 7EF70002h; ret	0_2_7EF7128F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF71E80 push 7EF70002h; ret	0_2_7EF71E8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF72A80 push 7EF70002h; ret	0_2_7EF72A8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF71670 push 7EF70002h; ret	0_2_7EF7167F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF72270 push 7EF70002h; ret	0_2_7EF7227F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF70E60 push 7EF70002h; ret	0_2_7EF70E6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF71A60 push 7EF70002h; ret	0_2_7EF71A6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF72660 push 7EF70002h; ret	0_2_7EF7266F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF71250 push 7EF70002h; ret	0_2_7EF7125F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF71E50 push 7EF70002h; ret	0_2_7EF71E5F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_7EF72A50 push 7EF70002h; ret	0_2_7EF72A5F

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name: entropy: 7.999649688016574
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name: entropy: 7.99052780466811
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name: entropy: 7.820875432384983
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Static PE information: section name: entropy: 7.992787647902555
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.999649688016574
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.99052780466811
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.820875432384983
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.992787647902555
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.999649688016574
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.99052780466811
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.820875432384983
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.992787647902555

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Stalling execution: Execution stalls by calling Sleep	graph_0-15461
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Stalling execution: Execution stalls by calling Sleep	graph_5-15308
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Stalling execution: Execution stalls by calling Sleep

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Window / User API: threadDelayed 666	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Window / User API: threadDelayed 839	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Window / User API: threadDelayed 654	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Window / User API: threadDelayed 395	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Window / User API: threadDelayed 4650	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 2228	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 6883	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 8049	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1009	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 4744	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 4362	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 4997	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 4073	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15849
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_5-15320
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_5-17806
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-17771

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe TID: 7416	Thread sleep count: 666 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe TID: 7428	Thread sleep count: 839 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe TID: 7428	Thread sleep time: -839000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe TID: 7432	Thread sleep count: 654 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe TID: 7432	Thread sleep time: -654000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe TID: 7416	Thread sleep count: 395 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe TID: 7416	Thread sleep time: -39895s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe TID: 7428	Thread sleep count: 4650 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe TID: 7428	Thread sleep time: -4650000s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7608	Thread sleep count: 2228 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7608	Thread sleep time: -2228000s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7616	Thread sleep count: 6883 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7616	Thread sleep time: -6883000s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7580	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7580	Thread sleep count: 342 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7580	Thread sleep time: -34542s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7592	Thread sleep count: 71 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7612	Thread sleep count: 8049 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7612	Thread sleep time: -8049000s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7620	Thread sleep count: 1009 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7620	Thread sleep time: -1009000s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7592	Thread sleep count: 338 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7592	Thread sleep time: -34138s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7668	Thread sleep count: 4744 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7668	Thread sleep time: -4744000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7680	Thread sleep count: 4362 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7680	Thread sleep time: -4362000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7656	Thread sleep count: 326 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7656	Thread sleep time: -32926s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7656	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8036	Thread sleep count: 66 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8048	Thread sleep count: 4997 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8048	Thread sleep time: -4997000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8056	Thread sleep count: 4073 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8056	Thread sleep time: -4073000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8036	Thread sleep count: 257 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8036	Thread sleep count: 71 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E01F8C FindClose,FindFirstFileExW,GetLastError,	0_2_00E01F8C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0126AD7B FindFirstFileA,	5_2_0126AD7B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00981F8C FindClose,FindFirstFileExW,GetLastError,	5_2_00981F8C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0126AD7B FindFirstFileA,	6_2_0126AD7B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00981F8C FindClose,FindFirstFileExW,GetLastError,	6_2_00981F8C
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00621F8C FindClose,FindFirstFileExW,GetLastError,	7_2_00621F8C

Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: RageMP131.exe, 00000007.00000003.1848014512.000000000190C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}<*
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.000000000092B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(K
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: RageMP131.exe, 0000000B.00000002.3569384353.0000000001817000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: vmware
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: RageMP131.exe, 0000000B.00000003.3403207278.00000000018F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_61F8D163
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.000000000095E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP@
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: MPGPH131.exe, 00000006.00000003.1788169635.0000000001A12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}R
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Hyper-V (guest)
Source: MPGPH131.exe, 00000005.00000002.3569605772.000000000176B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b})
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.00000000008C7000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.00000000008C7000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.00000000008C7000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: MPGPH131.exe, 00000006.00000003.1788169635.0000000001A12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}D
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: MPGPH131.exe, 00000005.00000003.1788194631.000000000176D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}(
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.000000000095E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3569605772.000000000178B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3569605772.000000000175B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819405097.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819215520.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3569205726.0000000001A01000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3569205726.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876833828.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570083740.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001937000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: RageMP131.exe, 0000000B.00000003.1952701329.0000000001815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: RageMP131.exe, 0000000B.00000003.3403207278.00000000018F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}es=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: RageMP131.exe, 0000000B.00000003.1952701329.0000000001817000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}zv
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: RageMP131.exe, 00000007.00000002.3569378412.000000000189E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000G3
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: RageMP131.exe, 0000000B.00000003.3403207278.00000000018F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000OfXwz2dz94dW9CO9/LCNFUZVGp7azu92pjOcuOzuJebb54RCki
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: xVBoxService.exe
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: MPGPH131.exe, 00000006.00000003.2819405097.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819215520.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3569205726.0000000001A32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: VBoxService.exe
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: VMWare
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: MPGPH131.exe, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: RageMP131.exe, 0000000B.00000002.3569384353.00000000017A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3567200602.0000000000797000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Code function: 0_2_00E08A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00E08A54

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

0_2_00E9C630

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E08A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E08A54
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E0450D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00E0450D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00988A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00988A54
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0098450D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0098450D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00988A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00988A54
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0098450D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0098450D
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_00628A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00628A54
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_0062450D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_0062450D

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: 0_2_00E9C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,	0_2_00E9C630
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00A1C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,	5_2_00A1C630
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00A1C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,	6_2_00A1C630
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: 7_2_006BC630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,	7_2_006BC630

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: EnumSystemLocalesW,	0_2_00E1B1A3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: GetLocaleInfoW,	0_2_00E231B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00E232E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: GetLocaleInfoW,	0_2_00E233E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00E22B48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00E234BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: EnumSystemLocalesW,	0_2_00E22DF4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: GetLocaleInfoW,	0_2_00E22D4D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: EnumSystemLocalesW,	0_2_00E22EDA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: EnumSystemLocalesW,	0_2_00E22E3F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00E22F65
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Code function: GetLocaleInfoW,	0_2_00E1B726
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_009A31B8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_0099B1A3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_009A32E1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_009A33E7
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	5_2_009A2B48
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_009A34BD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoA,	5_2_0126AD69
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_009A2DF4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_009A2D4D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_009A2EDA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_009A2E3F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_0099B726
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_009A2F65
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_009A31B8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_0099B1A3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_009A32E1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_009A33E7
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_009A2B48
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_009A34BD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoA,	6_2_0126AD69
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_009A2DF4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_009A2D4D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_009A2EDA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_009A2E3F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_0099B726
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_009A2F65
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: EnumSystemLocalesW,	7_2_0063B1A3
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: GetLocaleInfoW,	7_2_006431B8
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_006432E1
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	7_2_00642B48
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: GetLocaleInfoW,	7_2_006433E7
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_006434BD
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: GetLocaleInfoW,	7_2_00642D4D
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: EnumSystemLocalesW,	7_2_00642DF4
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: EnumSystemLocalesW,	7_2_00642E3F
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: EnumSystemLocalesW,	7_2_00642EDA
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	7_2_00642F65
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Code function: GetLocaleInfoW,	7_2_0063B726

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Code function: 0_2_00E0360D GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_00E0360D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Code function: 0_2_7EF71E20 GetUserNameA,

0_2_7EF71E20

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 0000000B.00000002.3569384353.00000000017A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3434983200.0000000001897000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3570549317.0000000001898000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 8032, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\QEGVANwj0k6bYEp2nEbzchm.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\walletsw
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Jaxx\Local Storage*
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\wallets[
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\wallets[
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets*
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet*
Source: RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 8032, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 0000000B.00000002.3569384353.00000000017A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3434983200.0000000001897000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3570549317.0000000001898000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 8032, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\QEGVANwj0k6bYEp2nEbzchm.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	12 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	34 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	221 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Virtualization/Sandbox Evasion	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	37%	ReversingLabs	Win32.Trojan.Generic
SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe	100%	Avira	HEUR/AGEN.1306558

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Avira	HEUR/AGEN.1306558
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	HEUR/AGEN.1306558
C:\ProgramData\MPGPH131\MPGPH131.exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	37%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://support.microsoft..	0%	URL Reputation	safe
http://193.233.132.167/cost/lenin.exe	100%	URL Reputation	malware
https://support.microsoft.	0%	URL Reputation	safe
http://pki-ocsp.symauth.com0	0%	URL Reputation	safe
http://147.45.47.102:57893/hera/amadka.ex	0%	Avira URL Cloud	safe
http://193.233.132.167/cost/go.exe	100%	Avira URL Cloud	malware
http://193.233.132.167/cost/lenin.exe.exe	100%	Avira URL Cloud	phishing
http://193.233.132.167/cost/go.exe.1	100%	Avira URL Cloud	phishing
http://147.45.47.102:57893/hera/amadka.exe	100%	Avira URL Cloud	malware
http://147.45.47.102:57893/hera	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		high
db-ip.com	104.26.5.15	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://db-ip.com/demo/home.php?s=149.18.24.96	false		high
https://ipinfo.io/widget/demo/149.18.24.96	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	3b6N2Xdh3CYwplaces.sqlite.11.dr	false		high
https://ipinfo.io:443/widget/demo/149.18.24.96	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.0000000000951000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3569605772.0000000001780000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819215520.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3569205726.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876833828.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570083740.0000000001920000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	false		high
https://ipinfo.io/:Z	MPGPH131.exe, 00000006.00000002.3569205726.00000000019D1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/lenin.exe.exe	RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://147.45.47.102:57893/hera/amadka.exe	RageMP131.exe, 00000007.00000002.3570083740.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	false		high
https://db-ip.com/	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000003.2484291481.0000000000997000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3568341169.000000000099A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3570587845.00000000017C6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2578480549.00000000017C3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819405097.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819215520.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3569205726.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876833828.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2877100726.0000000001968000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/riseproAD	MPGPH131.exe, 00000006.00000002.3569205726.0000000001A32000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.ex	RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	false		high
https://ipinfo.io/widget/demo/149.18.24.96R	MPGPH131.exe, 00000006.00000002.3569205726.00000000019E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	6IHWoe8lbZ9DHistory.11.dr, D4_tggVjtkMeHistory.11.dr	false		high
https://t.me/risepro	MPGPH131.exe, 00000005.00000002.3570587845.00000000017C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.microsoft..	RageMP131.exe, 0000000B.00000003.3401026967.0000000001889000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	low
http://193.233.132.167/cost/go.exe.1	RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ipinfo.io/widget/demo/149.18.24.96J	RageMP131.exe, 0000000B.00000002.3569384353.00000000017E2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exe	RageMP131.exe, 00000007.00000002.3570083740.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://db-ip.com/demo/home.php?s=149.18.24.96omdW	RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/149.18.24.96;74	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.0000000000951000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	6IHWoe8lbZ9DHistory.11.dr, D4_tggVjtkMeHistory.11.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	false		high
https://ipinfo.io/u	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.0000000000918000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/j	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.00000000008FB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/lenin.exe	RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://t.me/risepro_bot:g	MPGPH131.exe, 00000005.00000002.3570587845.00000000017C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/ch	RageMP131.exe, 0000000B.00000002.3569384353.0000000001817000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot.961740	RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botlaterH	RageMP131.exe, 00000007.00000003.2876833828.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2877100726.0000000001968000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot)f	RageMP131.exe, 00000007.00000003.2876833828.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2877100726.0000000001968000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	false		high
https://ipinfo.io:443/widget/demo/149.18.24.96o	RageMP131.exe, 0000000B.00000002.3569384353.00000000017A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.microsoft.	RageMP131.exe, 0000000B.00000003.3401026967.0000000001889000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORTAT	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3566559066.00000000005F1000.00000040.00000001.01000000.00000005.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	false		high
https://t.me/RiseProSUPPORT	RageMP131.exe, 0000000B.00000002.3570549317.0000000001898000.00000004.00000020.00020000.00000000.sdmp, QEGVANwj0k6bYEp2nEbzchm.zip.11.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	6IHWoe8lbZ9DHistory.11.dr, D4_tggVjtkMeHistory.11.dr	false		high
https://www.ecosia.org/newtab/	RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	false		high
https://ipinfo.io/Mozilla/5.0	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.0000000000951000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3569605772.0000000001780000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819215520.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3569205726.0000000001A25000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876833828.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570083740.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.0000000001825000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	3b6N2Xdh3CYwplaces.sqlite.11.dr	false		high
https://ac.ecosia.org/autocomplete?q=	RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	false		high
https://t.me/risepro_bot	RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399409021.0000000001889000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3402253621.000000000188A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2876552455.0000000001896000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2876513401.0000000001889000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3403590192.0000000001912000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3434983200.0000000001897000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3570549317.0000000001898000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937775107.0000000001889000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.11.dr	false		high
https://t.me/risepro_bot/M1	RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=149.18.24.96L	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000003.2484291481.0000000000997000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3568341169.000000000099A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/	RageMP131.exe, 00000007.00000002.3569378412.00000000018DF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3569378412.000000000189E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2877100726.0000000001968000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570083740.0000000001920000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570293007.000000000196A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3401026967.0000000001889000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3400228517.0000000001889000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.0000000001817000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.0000000001825000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399409021.0000000001889000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3402253621.000000000188A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2876513401.0000000001889000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937775107.0000000001889000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pki-ocsp.symauth.com0	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	false	URL Reputation: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	MPGPH131.exe, RageMP131.exe	false		high
http://147.45.47.102:57893/hera	RageMP131.exe, 00000007.00000002.3570083740.0000000001937000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com:443/demo/home.php?s=149.18.24.96	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3567222983.000000000095E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3569605772.000000000176B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819405097.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2819215520.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3569205726.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876833828.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3570083740.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2876465106.0000000001937000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3569384353.00000000017A7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.winimage.com/zLibDll	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe, 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.3566559066.00000000005F1000.00000040.00000001.01000000.00000005.sdmp	false		high
https://support.mozilla.org	3b6N2Xdh3CYwplaces.sqlite.11.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	6IHWoe8lbZ9DHistory.11.dr, D4_tggVjtkMeHistory.11.dr	false		high
https://t.me/RiseProSUPPORTKue	MPGPH131.exe, 00000006.00000002.3569205726.00000000019A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RageMP131.exe, 0000000B.00000003.2936742863.00000000018FF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.3399692582.000000000192B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2937402794.000000000192E000.00000004.00000020.00020000.00000000.sdmp, yQm3EH6MY0Q2Web Data.11.dr, fcfJXGhjOs0_Web Data.11.dr, G_ExU1umMCApWeb Data.11.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
104.26.5.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1434901
Start date and time:	2024-05-01 21:24:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/26@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.190.132, 40.126.62.130, 40.126.62.131, 20.190.190.195, 40.126.62.129, 20.190.190.196, 20.190.190.131, 20.190.190.129
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Simulations

Behavior and APIs

Time	Type	Description
20:25:21	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
20:25:23	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
20:25:23	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
20:25:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
21:25:53	API Interceptor	1453768x Sleep call for process: SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe modified
21:25:58	API Interceptor	2325349x Sleep call for process: MPGPH131.exe modified
21:26:06	API Interceptor	2015416x Sleep call for process: RageMP131.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
147.45.47.93	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse
	2zdult23rz.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.3413.25873.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
104.26.5.15	SecuriteInfo.com.Win64.Evo-gen.17494.7440.exe	Get hash	malicious	Unknown	Browse	api.db-ip.com/v2/free/127.0.0.1
	Nemty.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/84.17.52.2/countryName
	227.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/102.129.143.40/countryName

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	34.117.186.192
	2zdult23rz.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	34.117.186.192
	TomeluxGamex.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	TomeluxGamex.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
db-ip.com	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	172.67.75.166
	2zdult23rz.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	104.26.4.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	104.26.4.15
	SecuriteInfo.com.Win32.TrojanX-gen.3413.25873.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	34.117.186.192
	2zdult23rz.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	VOrqSh1Fts.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	34.117.186.192
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	34.117.186.192
	TomeluxGamex.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
FREE-NET-ASFREEnetEU	Iauncher.exe	Get hash	malicious	RedLine	Browse	147.45.47.65
	Iauncher.exe	Get hash	malicious	RedLine	Browse	147.45.47.65
	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	193.233.132.226
	2zdult23rz.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	fBirvIlaOJ.exe	Get hash	malicious	RedLine	Browse	147.45.47.36
	VOrqSh1Fts.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	193.233.132.234
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	147.45.47.93
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.47
CLOUDFLARENETUS	https://info.allproscales.com/e/1068402/v8lfjdMKG7A---MRecipient-Email/zkryx/856552164/h/EzPrTnytHknGOVFfyyn1-MkZGv58RodKhjD_VEx0VF0	Get hash	malicious	HTMLPhisher	Browse	172.67.164.163
	https://gettraff.ru/wb?keyword=aderant%20expert%20time%20entry	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://huntleypc-my.sharepoint.com/:b:/g/personal/danielle_huntleyimmigration_com/ERooJelgeBtJtoGwolFuy-ABXgjI9-lBvF-LpkrNwjPN5g?e=mVIvid	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Iauncher.exe	Get hash	malicious	RedLine	Browse	104.21.44.179
	Iauncher.exe	Get hash	malicious	RedLine	Browse	172.67.202.98
	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	172.67.151.19
	Sean Eichler.htm	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://www.canva.com/design/DAGEAa4PcvI/o5lifZGBI-4kJErApUzUSw/view?utm_content=DAGEAa4PcvI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.16.103.112
	[V2]launcher.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	104.21.73.118
	https://www.canva.com/design/DAGEAa4PcvI/o5lifZGBI-4kJErApUzUSw/view?utm_content=DAGEAa4PcvI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	104.26.5.15 34.117.186.192
	https://2625819278.org/MIg2p2	Get hash	malicious	HTMLPhisher	Browse	104.26.5.15 34.117.186.192
	https://securepdffilesaccess%E3%80%82com/docx/#9380ZWxsaW90LmdhbGxAZGFjb3RhaGJhbmsuY29t??RBgN==94664=/..=L5QpUY&u=276b8dda4ef94158348d5b6b8&id=6b7205781d#&vg=008d8185-7421-4d39-a8ea-d6571496b99e&stid=14&pti=1&pa=20041&pos=0&p=525094&channelId=21280b5d95ea9121&s=lsfbx0rnvkkgxzgo1sbi4b3z&sgs=2004:15-17+F-150	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.26.5.15 34.117.186.192
	2zdult23rz.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15 34.117.186.192
	baVrLvRHZY.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	lfY08S61Ig.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	TET8iWY1w4.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15 34.117.186.192
	Categories 30-04-2024.xlsx	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse
C:\ProgramData\MPGPH131\MPGPH131.exe	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3181568
Entropy (8bit):	7.9660802629270435
Encrypted:	false
SSDEEP:	49152:fxif1KBMZZVbyY8+z4UlzJz5kr8mqwRQ51QTtHSQ5WBEDVa6I9/fdwg0YY0fra:s1KB2/z4UR55yqfeTtyDBJRj0LJ
MD5:	8A5AC55FCE35D8A033DED9E56940152A
SHA1:	704B32B4695E9F591147E0A1B055FB15D66FC50D
SHA-256:	753C54477705A387E4A0DEE1F54529FA309172175CF22BAEA4DAE67B0005C1DD
SHA-512:	5350AF349685FEBF8EC12F70662C2623D3D49444C62C153137491347169706785F48B9D3E6FEFA9B528A2E8A87EE9643491EA5B02B7AAAF6F194948E6E469080
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Joe Sandbox View:	Filename: tZvjMg3Hw9.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y...s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L.....2f...............'............\.............@.......................................@... .. .... .. ..........P ......\-..............................0 ............................... .........................................................................................@.......................................@............P... .......0..............@................p.......8..............@................ ...`...8..............@....rsrc...............................@..@..........x..p...(...H..............@....data.... "......"..p..............@...................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3181568
Entropy (8bit):	7.9660802629270435
Encrypted:	false
SSDEEP:	49152:fxif1KBMZZVbyY8+z4UlzJz5kr8mqwRQ51QTtHSQ5WBEDVa6I9/fdwg0YY0fra:s1KB2/z4UR55yqfeTtyDBJRj0LJ
MD5:	8A5AC55FCE35D8A033DED9E56940152A
SHA1:	704B32B4695E9F591147E0A1B055FB15D66FC50D
SHA-256:	753C54477705A387E4A0DEE1F54529FA309172175CF22BAEA4DAE67B0005C1DD
SHA-512:	5350AF349685FEBF8EC12F70662C2623D3D49444C62C153137491347169706785F48B9D3E6FEFA9B528A2E8A87EE9643491EA5B02B7AAAF6F194948E6E469080
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Joe Sandbox View:	Filename: tZvjMg3Hw9.exe, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y...s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L.....2f...............'............\.............@.......................................@... .. .... .. ..........P ......\-..............................0 ............................... .........................................................................................@.......................................@............P... .......0..............@................p.......8..............@................ ...`...8..............@....rsrc...............................@..@..........x..p...(...H..............@....data.... "......"..p..............@...................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\QEGVANwj0k6bYEp2nEbzchm.zip

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5622
Entropy (8bit):	7.907632381450328
Encrypted:	false
SSDEEP:	96:bWGzqeAoMq+YK0KF8cAJiI2i+u5EoksydEmuNNkgh90Bx3KJy:nqASpF8wFiEordmuN14x6Jy
MD5:	A61B70A2B5BF7E5ABBC2F6039CAF11C1
SHA1:	DBBE8098C3340BBA0A8B8D1EF64CAA3670AF6944
SHA-256:	4DE31077B0040A69E92F7DD832ECDDB82100A2CD60B02092D9623628C3F85A96
SHA-512:	BF9315EB15CEBB41673C88F44C6D2835945AA340CDEF78D2D6B0C33DA0119A060B19ACA2E3649874B5CF57DFA0E78DBE65F032E5E69935738CBC96413C2327B8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\QEGVANwj0k6bYEp2nEbzchm.zip, Author: Joe Security
Preview:	PK......... .X................Cookies\..PK.........!.XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:Lthl:jl
MD5:	0E21E271B36CFDBE2F435D735A5673E2
SHA1:	1F232568CB7BDED044CD9DA734A0A1BC4CC33A96
SHA-256:	24CE6464BCACEA0E1E866010EF01CE09C337754CF5EA5A619F0E6A6055CD45F8
SHA-512:	924F17B4B4F0C152EFA00CDF0F091D0D962D07707E9292B8C26BEA8A56FC2C7DDBCE77034172064A14619B313ED4BB83AD1F08A73D2AC8B1DAE85E02156DC8BD
Malicious:	false
Preview:	1714595572273

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\21DwcKzffyvaHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\6IHWoe8lbZ9DHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\7_kVUmGHRa2QCookies

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\B3Goucp0LR0WHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\D4_tggVjtkMeHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\G_ExU1umMCApWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\H6IiOe1a4hMNWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\KBaxgQuPqXyZWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\VuhoTc5LnxleLogin Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\bIxp5h8t6jVCLogin Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\fcfJXGhjOs0_Web Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\pYWgEYS5jDmHWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\yQm3EH6MY0Q2Web Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\zMQYNC4o8CfOLogin Data For Account

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyDslgJunaCvTA\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyDslgJunaCvTA\information.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7056
Entropy (8bit):	5.50893406504588
Encrypted:	false
SSDEEP:	192:xWeGvAtphWhcBXb/wrzNm9REdpUT2A3pWah2wi02GlABnKU2z2PNZoNi/3b2e2ue:NGvAtfWhcBXb/wrzNm9REdpUqA3pWags
MD5:	E9A956A00C6E36AFF62AEC734F184183
SHA1:	85A901AC729262F94AD19790DC855E3321F8ABA1
SHA-256:	4CC2FA4F8A620F3FEAB044FA89CED8B0065B3F65FA8887043BB8EF0B84C9F363
SHA-512:	9AE435046A7A5BCE16AAFC51997B2340DE85FF2042DB82DD269DFB742162129E98D804A16B9490BEF75DB631C9D1D4830EAE1CA9F51F5C68145F638A87CDF780
Malicious:	false
Preview:	Build: buben..Version: 1.9....Date: Tue May 28 04:04:32 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 5e89b3611d86ec7f563db220048eb86e....Path: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyDslgJunaCvTA....IP: 149.18.24.96..Location: US, Washington..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 971342 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 28/5/2024 4:4:32..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..font

C:\Users\user\AppData\Local\Temp\trixyDslgJunaCvTA\passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9660802629270435
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe
File size:	3'181'568 bytes
MD5:	8a5ac55fce35d8a033ded9e56940152a
SHA1:	704b32b4695e9f591147e0a1b055fb15d66fc50d
SHA256:	753c54477705a387e4a0dee1f54529fa309172175cf22baea4dae67b0005c1dd
SHA512:	5350af349685febf8ec12f70662c2623d3d49444c62c153137491347169706785f48b9d3e6fefa9b528a2e8a87ee9643491ea5b02b7aaaf6f194948e6e469080
SSDEEP:	49152:fxif1KBMZZVbyY8+z4UlzJz5kr8mqwRQ51QTtHSQ5WBEDVa6I9/fdwg0YY0fra:s1KB2/z4UR55yqfeTtyDBJRj0LJ
TLSH:	9EE533EB1195F20CFD8849F55D9FCB3305959EBD462B2C84A1D3BEB7307BC461AA8098
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	4c4d96ec0ce6c600

Static PE Info

General

Entrypoint:	0xf4f65c
Entrypoint Section:	.data
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x663202DB [Wed May 1 08:52:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	272279f18f704f637aa129691266b291

Entrypoint Preview

Instruction
jmp 00007FF134B0FD8Ah
add byte ptr [eax+0Eh], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax-18h], ah
add byte ptr [eax], al
add byte ptr [eax], al
pop ebp
sub ebp, 00000010h
sub ebp, 00B4F65Ch
jmp 00007FF134B0FD89h
or eax, B869C46Fh
pop esp
div byte ptr [eax+eax-3F7E3AFDh]
dec esp
add byte ptr [eax], al
add byte ptr [ecx+000005A8h], bh
mov edx, 76178C63h
xor byte ptr [eax], dl
inc eax
dec ecx
jne 00007FF134B0FD7Ch
jmp 00007FF134B0FD89h
and eax, E821EA00h
scasb
call 00007FF198145D6Fh
arpl dx, sp
mov byte ptr [6363639Bh], al
pushad
scasb

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x932050	0xd09	.data
IMAGE_DIRECTORY_ENTRY_IMPORT	0x932d5c	0x3b0	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19c000	0xafa0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x932030	0x10	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x932000	0x18	.data
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x159000	0x92a00	52e4d0d27c5a8f727cafbaa7a758e5ee	False	0.9997519048380221	data	7.999649688016574	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x15a000	0x28000	0x10200	e89599a8c905db2eb8d646a12a5aeb90	False	0.9934290213178295	data	7.99052780466811	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x182000	0x5000	0x800	a32ff45cd995e809dc34a34d15496f7a	False	0.99267578125	data	7.820875432384983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x187000	0xb000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x192000	0xa000	0x6000	e9b705d42392314870705a9af25076bd	False	1.0006510416666667	SysEx File -	7.992787647902555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19c000	0xb000	0xb000	f55c5215c73a04b580fdee8f27a08ae5	False	0.11330344460227272	data	2.153423809128472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x1a7000	0x788000	0x32800	1acf9b95807838523f488e92264571a4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x92f000	0x222000	0x221c00	142410e31e8a64067e2fea7a6a37d478	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19c250	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Russian	Russia	0.1320921985815603
RT_ICON	0x19c6b8	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1600	Russian	Russia	0.10465116279069768
RT_ICON	0x19cd70	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Russian	Russia	0.08770491803278689
RT_ICON	0x19d6f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Russian	Russia	0.05722326454033771
RT_ICON	0x19e7a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Russian	Russia	0.03475103734439834
RT_ICON	0x1a0d48	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	Russian	Russia	0.02509447331128956
RT_ICON	0x1a4f70	0x1aae	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.39780380673499266
RT_GROUP_ICON	0x1a6a20	0x68	data	Russian	Russia	0.7596153846153846
RT_VERSION	0x1a6a88	0x398	OpenPGP Public Key	Russian	Russia	0.42282608695652174
RT_MANIFEST	0x1a6e20	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
ole32.dll	CoInitialize
WS2_32.dll	WSAStartup
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders
SETUPAPI.dll	SetupDiEnumDeviceInfo
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/01/24-21:28:21.747237	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49731	58709	192.168.2.4	147.45.47.93
05/01/24-21:28:07.401095	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49740	58709	192.168.2.4	147.45.47.93
05/01/24-21:26:25.313213	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49730	147.45.47.93	192.168.2.4
05/01/24-21:25:22.952144	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49730	147.45.47.93	192.168.2.4
05/01/24-21:28:21.731238	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49730	58709	192.168.2.4	147.45.47.93
05/01/24-21:25:22.787637	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49730	58709	192.168.2.4	147.45.47.93
05/01/24-21:25:33.353823	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49733	147.45.47.93	192.168.2.4
05/01/24-21:26:25.907179	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49733	147.45.47.93	192.168.2.4
05/01/24-21:25:27.381179	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49732	147.45.47.93	192.168.2.4
05/01/24-21:25:27.359968	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49731	147.45.47.93	192.168.2.4
05/01/24-21:26:26.205307	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49740	147.45.47.93	192.168.2.4
05/01/24-21:25:43.854924	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49740	147.45.47.93	192.168.2.4
05/01/24-21:26:25.562531	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49731	147.45.47.93	192.168.2.4
05/01/24-21:26:25.578399	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49732	147.45.47.93	192.168.2.4
05/01/24-21:28:21.838617	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49733	58709	192.168.2.4	147.45.47.93
05/01/24-21:28:21.779239	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49732	58709	192.168.2.4	147.45.47.93

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 21:25:22.536684036 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:22.743758917 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:25:22.743829012 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:22.787636995 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:22.952143908 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:25:22.994142056 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:23.036832094 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:25:26.246426105 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:26.506093025 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:25:26.944911957 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:26.964804888 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:27.152410984 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:25:27.152519941 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:27.163434029 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:25:27.163505077 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:27.173763037 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:27.174129963 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:27.359967947 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:25:27.381179094 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:25:27.400408030 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:27.427766085 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:25:27.433952093 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:30.606602907 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:30.606777906 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:30.849961996 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:25:30.864993095 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:25:32.938488007 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:33.146033049 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:25:33.146267891 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:33.156392097 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:33.353822947 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:25:33.400429964 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:33.412201881 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:25:36.593226910 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:36.849450111 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:25:43.404674053 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:43.613454103 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:25:43.613564014 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:43.625684023 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:43.854923964 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:25:43.900470018 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:46.994354010 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:47.256174088 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:25:59.119379997 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:25:59.380968094 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:02.911839008 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:02.911912918 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:03.162487030 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:03.162652969 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:08.869693041 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:08.869801998 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:09.130764008 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:09.130785942 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:15.166704893 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:15.427872896 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:15.619611025 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:15.619718075 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:15.865510941 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:15.881042957 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:18.291781902 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:18.552758932 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:18.929616928 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:19.178109884 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:21.420030117 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:21.420109987 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:21.677777052 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:21.677791119 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:22.994589090 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:22.994682074 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:23.240539074 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:23.256016016 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:24.572236061 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:24.834083080 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:25.313213110 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:25.363082886 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:25.562530994 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:25.578398943 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:25.603718042 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:25.621920109 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:25.859685898 CEST	49742	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:25.859724045 CEST	443	49742	34.117.186.192	192.168.2.4
May 1, 2024 21:26:25.859833002 CEST	49742	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:25.864847898 CEST	49743	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:25.864883900 CEST	443	49743	34.117.186.192	192.168.2.4
May 1, 2024 21:26:25.864959002 CEST	49743	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:25.867724895 CEST	49744	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:25.867733002 CEST	443	49744	34.117.186.192	192.168.2.4
May 1, 2024 21:26:25.867791891 CEST	49744	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:25.899658918 CEST	49744	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:25.899681091 CEST	443	49744	34.117.186.192	192.168.2.4
May 1, 2024 21:26:25.901757956 CEST	49743	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:25.901777029 CEST	443	49743	34.117.186.192	192.168.2.4
May 1, 2024 21:26:25.902115107 CEST	49742	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:25.902141094 CEST	443	49742	34.117.186.192	192.168.2.4
May 1, 2024 21:26:25.907179117 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:25.947485924 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:26.010564089 CEST	49745	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.010600090 CEST	443	49745	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.010660887 CEST	49745	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.012118101 CEST	49745	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.012128115 CEST	443	49745	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.101386070 CEST	443	49744	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.101533890 CEST	49744	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.102693081 CEST	443	49742	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.102714062 CEST	443	49743	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.102868080 CEST	49742	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.104116917 CEST	49743	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.104116917 CEST	49744	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.104134083 CEST	443	49744	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.104424000 CEST	443	49744	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.104748964 CEST	49742	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.104758024 CEST	443	49742	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.105017900 CEST	443	49742	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.105448961 CEST	49743	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.105454922 CEST	443	49743	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.105710983 CEST	443	49743	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.150705099 CEST	49744	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.150705099 CEST	49743	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.150715113 CEST	49742	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.181766033 CEST	49743	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.193159103 CEST	49742	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.199461937 CEST	49744	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.205307007 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:26.214221001 CEST	443	49745	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.214387894 CEST	49745	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.216794014 CEST	49745	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.216804981 CEST	443	49745	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.217148066 CEST	443	49745	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.228130102 CEST	443	49743	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.236159086 CEST	443	49742	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.240113020 CEST	443	49744	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.259955883 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:26.259983063 CEST	49745	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.271831989 CEST	49745	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.312134981 CEST	443	49745	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.329014063 CEST	443	49742	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.329171896 CEST	443	49742	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.329286098 CEST	49742	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.329592943 CEST	443	49743	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.329735994 CEST	443	49743	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.329782009 CEST	49743	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.334498882 CEST	443	49744	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.334604979 CEST	443	49744	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.334667921 CEST	49744	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.361538887 CEST	49744	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.361571074 CEST	443	49744	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.361586094 CEST	49744	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.361592054 CEST	443	49744	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.361603975 CEST	49742	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.361635923 CEST	443	49742	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.361682892 CEST	49742	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.361689091 CEST	443	49742	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.361736059 CEST	49743	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.361741066 CEST	443	49743	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.361757040 CEST	49743	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.361759901 CEST	443	49743	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.433279037 CEST	49746	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.433326006 CEST	443	49746	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.433393955 CEST	49746	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.434642076 CEST	49746	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.434659004 CEST	443	49746	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.435190916 CEST	443	49745	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.435300112 CEST	443	49745	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.435350895 CEST	49745	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.435705900 CEST	49745	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.435719013 CEST	443	49745	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.435729027 CEST	49745	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.435734034 CEST	443	49745	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.467876911 CEST	49747	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.467916012 CEST	443	49747	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.467995882 CEST	49747	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.468838930 CEST	49747	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.468853951 CEST	443	49747	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.469346046 CEST	49749	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.469393015 CEST	443	49749	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.469427109 CEST	49748	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.469439983 CEST	443	49748	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.469482899 CEST	49749	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.469518900 CEST	49748	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.469943047 CEST	49748	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.469957113 CEST	443	49748	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.470146894 CEST	49749	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.470156908 CEST	443	49749	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.470868111 CEST	49750	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.470910072 CEST	443	49750	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.470978975 CEST	49750	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.471251011 CEST	49750	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.471262932 CEST	443	49750	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.630219936 CEST	443	49746	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.630289078 CEST	49746	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.631795883 CEST	49746	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.631805897 CEST	443	49746	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.632045031 CEST	443	49746	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.670736074 CEST	443	49749	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.670803070 CEST	49749	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.671341896 CEST	443	49747	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.671401978 CEST	49747	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.672894001 CEST	443	49750	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.672949076 CEST	49750	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.676326990 CEST	443	49748	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.676383972 CEST	49748	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.680999994 CEST	49749	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.681025982 CEST	443	49749	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.681268930 CEST	443	49749	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.681840897 CEST	49746	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.683218002 CEST	49747	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.683232069 CEST	443	49747	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.683514118 CEST	443	49747	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.685237885 CEST	49747	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.687206984 CEST	49750	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.687239885 CEST	443	49750	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.687577009 CEST	443	49750	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.689167976 CEST	49750	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.690340996 CEST	49748	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.690360069 CEST	443	49748	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.691529989 CEST	443	49748	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.693087101 CEST	49748	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.703123093 CEST	49749	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.709512949 CEST	49746	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.732119083 CEST	443	49747	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.736116886 CEST	443	49750	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.740113020 CEST	443	49748	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.744119883 CEST	443	49749	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.756129980 CEST	443	49746	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.853899956 CEST	443	49746	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.854022026 CEST	443	49746	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.854080915 CEST	49746	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.854551077 CEST	49746	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.854572058 CEST	443	49746	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.854583979 CEST	49746	443	192.168.2.4	34.117.186.192
May 1, 2024 21:26:26.854588985 CEST	443	49746	34.117.186.192	192.168.2.4
May 1, 2024 21:26:26.855998039 CEST	49751	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.856038094 CEST	443	49751	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.856091022 CEST	49751	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.856436014 CEST	49751	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.856450081 CEST	443	49751	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.949851036 CEST	443	49747	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.949945927 CEST	443	49747	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.949991941 CEST	49747	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.950135946 CEST	49747	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.950150013 CEST	443	49747	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.950165987 CEST	49747	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.950170994 CEST	443	49747	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.950582981 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:26.951071024 CEST	443	49750	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.951169968 CEST	443	49750	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.951210976 CEST	49750	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.951342106 CEST	49750	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.951358080 CEST	443	49750	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.951369047 CEST	49750	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.951375008 CEST	443	49750	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.951694965 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:26.959259033 CEST	443	49748	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.959376097 CEST	443	49748	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.959424973 CEST	49748	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.959552050 CEST	49748	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.959568024 CEST	443	49748	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.959580898 CEST	49748	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.959585905 CEST	443	49748	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.959944010 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:26.961407900 CEST	443	49749	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.961536884 CEST	443	49749	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.961591959 CEST	49749	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.962490082 CEST	49749	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.962506056 CEST	443	49749	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.962522030 CEST	49749	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:26.962536097 CEST	443	49749	104.26.5.15	192.168.2.4
May 1, 2024 21:26:26.962825060 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:27.053378105 CEST	443	49751	104.26.5.15	192.168.2.4
May 1, 2024 21:26:27.053448915 CEST	49751	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:27.055201054 CEST	49751	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:27.055212021 CEST	443	49751	104.26.5.15	192.168.2.4
May 1, 2024 21:26:27.055450916 CEST	443	49751	104.26.5.15	192.168.2.4
May 1, 2024 21:26:27.056792974 CEST	49751	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:27.104125977 CEST	443	49751	104.26.5.15	192.168.2.4
May 1, 2024 21:26:27.209115982 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:27.209140062 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:27.209151983 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:27.224797010 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:27.328027964 CEST	443	49751	104.26.5.15	192.168.2.4
May 1, 2024 21:26:27.328150988 CEST	443	49751	104.26.5.15	192.168.2.4
May 1, 2024 21:26:27.328296900 CEST	49751	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:27.328854084 CEST	49751	443	192.168.2.4	104.26.5.15
May 1, 2024 21:26:27.328870058 CEST	443	49751	104.26.5.15	192.168.2.4
May 1, 2024 21:26:27.329936981 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:27.430403948 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:27.478816032 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:27.571160078 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:27.583870888 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:27.586348057 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:27.619353056 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:27.635024071 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:27.743238926 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:27.791280031 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:28.038999081 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:28.088176012 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:29.085803032 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:29.136549950 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:29.850797892 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:29.867506027 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:29.901019096 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:29.917244911 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:30.008639097 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:30.056958914 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:30.288882971 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:30.338094950 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:32.213443995 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:32.474967957 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:32.963615894 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:32.994601965 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:33.150990009 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:33.224697113 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:33.240462065 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:33.412456036 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:33.416438103 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:33.677884102 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:34.461990118 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:34.478096962 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:34.588113070 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:34.650605917 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:35.353960991 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:35.615447998 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:36.291387081 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:36.552942038 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:36.554003954 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:36.634028912 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:37.603965044 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:37.619508982 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:37.865428925 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:37.865449905 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:38.494537115 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:38.755898952 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:38.776896000 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:38.807284117 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:39.068485975 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:39.837127924 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:40.100006104 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:40.955557108 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:40.955560923 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:41.208967924 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:41.208992958 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:41.497997046 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:41.526456118 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:41.629386902 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:41.787164927 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:41.880737066 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:41.924999952 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:42.178117037 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:42.445537090 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:42.681946993 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:42.865344048 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:42.865472078 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:44.088555098 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:44.088633060 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:44.289928913 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:44.334450006 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:44.349967003 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:44.447658062 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:45.143126011 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:45.396461010 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:45.631612062 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:45.776808977 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:45.881192923 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:45.881326914 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:46.131134987 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:47.307429075 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:47.307493925 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:47.525899887 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:47.553311110 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:47.568382978 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:47.787415981 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:48.636013985 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:48.896646023 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:48.916609049 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:49.177839041 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:49.382778883 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:49.397294044 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:49.447608948 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:49.522351980 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:49.572546959 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:49.586822033 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:49.757308006 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:49.885071039 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:50.853054047 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:50.996041059 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:51.010349989 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:51.025269032 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:51.072599888 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:51.072663069 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:51.124707937 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:51.271866083 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:51.365370035 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:51.694581032 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:51.744467974 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:51.773473024 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:51.885055065 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:53.414736032 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:53.476227999 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:53.491590023 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:53.572613001 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:53.573106050 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:53.635143995 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:54.244281054 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.291812897 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:54.325567961 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.325591087 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.325603962 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.325619936 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.325634003 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.325649977 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.325654030 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:54.325668097 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.325681925 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.325695992 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.325709105 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.325715065 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:54.325735092 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:54.325752974 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:54.533770084 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.533797979 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.533812046 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.533826113 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.533840895 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.533855915 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.533901930 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:54.533962011 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:54.552750111 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:54.620155096 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:54.880940914 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:56.591617107 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:56.604186058 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:56.620269060 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:56.849947929 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:56.865597963 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:56.865614891 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:57.303716898 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:57.366488934 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:26:57.382510900 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:26:57.385107994 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:57.385318041 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:57.447551966 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:57.572567940 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:57.646922112 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:57.651066065 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:57.912477970 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:58.070822954 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:26:58.135139942 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:58.147639990 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:26:58.385113001 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:26:59.804054976 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:26:59.885070086 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:00.479069948 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:00.494812012 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:00.538566113 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.553860903 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.592184067 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:00.637057066 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.637079000 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.637098074 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.637113094 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.637129068 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.637135029 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:00.637144089 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.637160063 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.637176991 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.637178898 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:00.637192011 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.637193918 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:00.637209892 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.637236118 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:00.637263060 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:00.681951046 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:00.713897943 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.740163088 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.740202904 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.791744947 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:00.844729900 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.844753027 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.844775915 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.844815016 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.844831944 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.844846010 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:00.844860077 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:00.844984055 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:01.052922964 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:01.508840084 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:01.555993080 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:01.570611000 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:01.572592020 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:01.633457899 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:01.650716066 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:01.681956053 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:01.710283041 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:01.838252068 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:01.885118008 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:02.021581888 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:02.025201082 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:04.214462042 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:04.242326975 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:04.258624077 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:04.291749001 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:04.318532944 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:04.385102034 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:04.416623116 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:04.416693926 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:04.553451061 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:04.838583946 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:05.099845886 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:06.808696032 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:06.885111094 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:07.339116096 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:07.403520107 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:07.403768063 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:07.599817991 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:07.646922112 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:07.662559032 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:09.947890043 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:10.209151030 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:10.744820118 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:10.744890928 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:10.744929075 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:10.990748882 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:11.005841017 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:11.005857944 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:13.088439941 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:13.349725008 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:13.885577917 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:13.885648966 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:13.885720968 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:14.131442070 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:14.146908045 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:14.147078037 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:16.073370934 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:16.229501009 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:16.334378004 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:16.334434986 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:16.490313053 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:16.584563017 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:17.019364119 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:17.019390106 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:17.019499063 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:17.271800041 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:17.271815062 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:17.271884918 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:19.370318890 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:19.463671923 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:19.631334066 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:19.724893093 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:20.135355949 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:20.135382891 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:20.135426044 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:20.381159067 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:20.396776915 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:20.396800041 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:22.510946989 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:22.589196920 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:22.771977901 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:22.849759102 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:23.276166916 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:23.276228905 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:23.276285887 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:23.521693945 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:23.537266970 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:23.537287951 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:25.635494947 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:25.713449001 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:25.896761894 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:25.975097895 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:26.416692972 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:26.416737080 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:26.416812897 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:26.662513971 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:26.678062916 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:26.678093910 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:28.775986910 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:28.838736057 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:29.037161112 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:29.099888086 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:29.557382107 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:29.557390928 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:29.557475090 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:29.803167105 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:29.818702936 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:29.818720102 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:31.916651964 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:31.963546038 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:32.177901030 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:32.224845886 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:32.697988987 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:32.698059082 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:32.698060036 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:32.943614006 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:32.959213018 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:32.959228992 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:35.041676998 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:35.104281902 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:35.303169012 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:35.365390062 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:35.822896004 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:35.822901011 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:35.823046923 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:36.068844080 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:36.084404945 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:36.084419012 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:38.166676044 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:38.245023012 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:38.428245068 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:38.506053925 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:38.963576078 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:38.963658094 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:38.963660002 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:39.211533070 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:39.227030993 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:39.227171898 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:41.307655096 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:41.385469913 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:41.568598986 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:41.647034883 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:42.104161024 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:42.104177952 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:42.104233980 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:42.349942923 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:42.365514994 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:42.365530968 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:44.448003054 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:44.510529995 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:44.709104061 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:44.771740913 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:45.229157925 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:45.229240894 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:45.229262114 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:45.474987984 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:45.490638971 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:45.490655899 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:47.588718891 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:47.635535955 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:47.850296974 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:47.896569014 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:48.354233980 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:48.354324102 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:48.354321957 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:48.599921942 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:48.615489006 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:48.615506887 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:50.713824987 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:50.776067972 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:50.974843979 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:51.037457943 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:51.479306936 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:51.479317904 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:51.479376078 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:51.725091934 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:51.740634918 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:51.740655899 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:53.838664055 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:53.916735888 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:54.099824905 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:54.178150892 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:54.569576979 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:54.603852034 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:54.619761944 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:54.619844913 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:54.635462999 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:54.775897980 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:54.777745008 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:54.865556002 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:54.869570017 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:54.896825075 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:55.115550995 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:55.476336002 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:55.507759094 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:55.522375107 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:55.572746992 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:55.573174953 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:55.605173111 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:55.619842052 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:55.650892019 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:55.805483103 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:27:55.881040096 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:55.885283947 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:58.604350090 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:58.635473013 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:58.635509014 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:58.745351076 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:58.865533113 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:27:58.881289959 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:27:58.896828890 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:27:58.932416916 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:27:59.006287098 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:27:59.194050074 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:28:01.729316950 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:01.760560036 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:01.760579109 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:01.869893074 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:01.990662098 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:28:02.006325960 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:28:02.021910906 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:28:02.057351112 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:02.131221056 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:28:02.319025040 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:28:03.367536068 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:28:03.398979902 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:28:03.414099932 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:28:03.519082069 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:03.588403940 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:03.588480949 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:04.288732052 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:28:04.385373116 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:05.010545969 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:05.271766901 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:28:06.479249001 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:06.510432005 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:06.526078939 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:06.740415096 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:28:06.771759033 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:28:06.771785021 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:28:07.401094913 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:07.662287951 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:28:08.135638952 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:08.396735907 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:28:08.737859964 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:08.737977982 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:08.945918083 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:28:08.946007013 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:28:08.946021080 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:28:08.946034908 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:09.194103956 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:28:09.607228994 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:09.639224052 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:09.651201010 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:09.865904093 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:28:09.896768093 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:28:09.896794081 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:28:10.085731030 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:28:10.117101908 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:28:10.132127047 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:28:10.178822994 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:28:10.216742039 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:10.275906086 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:10.275969982 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:10.319755077 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:28:10.336569071 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:10.385274887 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:11.776310921 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:11.985289097 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:28:13.201436043 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:13.244884968 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:13.260528088 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:13.307573080 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:13.459130049 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:28:13.506148100 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:28:13.506174088 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:28:13.569034100 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:28:16.338695049 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:16.369940996 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:16.385576963 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:16.448007107 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:16.600245953 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:28:16.631088018 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:28:16.631108046 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:28:16.700263977 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:28:18.601741076 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:28:18.632256985 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:28:18.648587942 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:28:18.710263968 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:28:18.747231960 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:18.776005030 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:18.779237986 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:18.808530092 CEST	58709	49740	147.45.47.93	192.168.2.4
May 1, 2024 21:28:18.808660030 CEST	49740	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:18.951323032 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:21.731237888 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:21.747236967 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:21.779238939 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:21.838617086 CEST	49733	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:21.990612030 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:28:22.006256104 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:28:22.021951914 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:28:22.099889040 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:28:23.930005074 CEST	58709	49730	147.45.47.93	192.168.2.4
May 1, 2024 21:28:23.975965977 CEST	58709	49731	147.45.47.93	192.168.2.4
May 1, 2024 21:28:23.991672039 CEST	58709	49732	147.45.47.93	192.168.2.4
May 1, 2024 21:28:24.039479017 CEST	58709	49733	147.45.47.93	192.168.2.4
May 1, 2024 21:28:24.053514957 CEST	49731	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:24.088459015 CEST	49730	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:24.088520050 CEST	49732	58709	192.168.2.4	147.45.47.93
May 1, 2024 21:28:24.168821096 CEST	49733	58709	192.168.2.4	147.45.47.93

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 21:26:25.754127979 CEST	59201	53	192.168.2.4	1.1.1.1
May 1, 2024 21:26:25.850019932 CEST	53	59201	1.1.1.1	192.168.2.4
May 1, 2024 21:26:26.367821932 CEST	64183	53	192.168.2.4	1.1.1.1
May 1, 2024 21:26:26.466456890 CEST	53	64183	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 1, 2024 21:26:25.754127979 CEST	192.168.2.4	1.1.1.1	0x2612	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 1, 2024 21:26:26.367821932 CEST	192.168.2.4	1.1.1.1	0x1a89	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 1, 2024 21:26:25.850019932 CEST	1.1.1.1	192.168.2.4	0x2612	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
May 1, 2024 21:26:26.466456890 CEST	1.1.1.1	192.168.2.4	0x1a89	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
May 1, 2024 21:26:26.466456890 CEST	1.1.1.1	192.168.2.4	0x1a89	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
May 1, 2024 21:26:26.466456890 CEST	1.1.1.1	192.168.2.4	0x1a89	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	34.117.186.192	443	7576	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 19:26:26 UTC	237	OUT	GET /widget/demo/149.18.24.96 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-01 19:26:26 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Wed, 01 May 2024 19:26:26 GMT content-type: application/json; charset=utf-8 Content-Length: 959 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-01 19:26:26 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "149.18.24.96", "data": { "ip": "149.18.24.96", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2024-05-01 19:26:26 UTC	217	IN	Data Raw: 64 64 72 65 73 73 22 3a 20 22 55 53 2c 20 4e 59 2c 20 47 72 65 65 6e 6c 61 77 6e 2c 20 35 35 20 42 72 6f 61 64 77 61 79 2c 20 23 36 38 36 2c 20 31 31 37 34 30 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 6c 6f 67 69 63 77 65 62 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 34 39 2e 31 38 2e 30 2e 30 2f 31 36 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 33 34 37 2d 32 31 32 2d 35 30 34 37 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ddress": "US, NY, Greenlawn, 55 Broadway, #686, 11740", "country": "US", "email": "abuse@logicweb.com", "name": "Abuse", "network": "149.18.0.0/16", "phone": "+1-347-212-5047" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	34.117.186.192	443	7412	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 19:26:26 UTC	237	OUT	GET /widget/demo/149.18.24.96 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-01 19:26:26 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Wed, 01 May 2024 19:26:26 GMT content-type: application/json; charset=utf-8 Content-Length: 959 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-01 19:26:26 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "149.18.24.96", "data": { "ip": "149.18.24.96", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2024-05-01 19:26:26 UTC	217	IN	Data Raw: 64 64 72 65 73 73 22 3a 20 22 55 53 2c 20 4e 59 2c 20 47 72 65 65 6e 6c 61 77 6e 2c 20 35 35 20 42 72 6f 61 64 77 61 79 2c 20 23 36 38 36 2c 20 31 31 37 34 30 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 6c 6f 67 69 63 77 65 62 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 34 39 2e 31 38 2e 30 2e 30 2f 31 36 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 33 34 37 2d 32 31 32 2d 35 30 34 37 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ddress": "US, NY, Greenlawn, 55 Broadway, #686, 11740", "country": "US", "email": "abuse@logicweb.com", "name": "Abuse", "network": "149.18.0.0/16", "phone": "+1-347-212-5047" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49744	34.117.186.192	443	7588	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 19:26:26 UTC	237	OUT	GET /widget/demo/149.18.24.96 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-01 19:26:26 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Wed, 01 May 2024 19:26:26 GMT content-type: application/json; charset=utf-8 Content-Length: 959 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 6 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-01 19:26:26 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "149.18.24.96", "data": { "ip": "149.18.24.96", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2024-05-01 19:26:26 UTC	217	IN	Data Raw: 64 64 72 65 73 73 22 3a 20 22 55 53 2c 20 4e 59 2c 20 47 72 65 65 6e 6c 61 77 6e 2c 20 35 35 20 42 72 6f 61 64 77 61 79 2c 20 23 36 38 36 2c 20 31 31 37 34 30 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 6c 6f 67 69 63 77 65 62 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 34 39 2e 31 38 2e 30 2e 30 2f 31 36 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 33 34 37 2d 32 31 32 2d 35 30 34 37 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ddress": "US, NY, Greenlawn, 55 Broadway, #686, 11740", "country": "US", "email": "abuse@logicweb.com", "name": "Abuse", "network": "149.18.0.0/16", "phone": "+1-347-212-5047" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	34.117.186.192	443	7652	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 19:26:26 UTC	237	OUT	GET /widget/demo/149.18.24.96 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-01 19:26:26 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Wed, 01 May 2024 19:26:26 GMT content-type: application/json; charset=utf-8 Content-Length: 959 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-01 19:26:26 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "149.18.24.96", "data": { "ip": "149.18.24.96", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2024-05-01 19:26:26 UTC	217	IN	Data Raw: 64 64 72 65 73 73 22 3a 20 22 55 53 2c 20 4e 59 2c 20 47 72 65 65 6e 6c 61 77 6e 2c 20 35 35 20 42 72 6f 61 64 77 61 79 2c 20 23 36 38 36 2c 20 31 31 37 34 30 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 6c 6f 67 69 63 77 65 62 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 34 39 2e 31 38 2e 30 2e 30 2f 31 36 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 33 34 37 2d 32 31 32 2d 35 30 34 37 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ddress": "US, NY, Greenlawn, 55 Broadway, #686, 11740", "country": "US", "email": "abuse@logicweb.com", "name": "Abuse", "network": "149.18.0.0/16", "phone": "+1-347-212-5047" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	104.26.5.15	443	7412	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 19:26:26 UTC	261	OUT	GET /demo/home.php?s=149.18.24.96 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-01 19:26:26 UTC	650	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 19:26:26 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC462B0B:75C2_93878F2E:0050_66329762_B05AC5E:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2qn5aHwsXwIVuUoK3cBsUvjoQUngbYSxH0irO109psSAB1ClpFdc3LQn5HAUbkrV9GPJcNHQnFkycUnqkID34CX1sez2tYEEdciDLHWT%2FmKrtcUPlX4kge3LGg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d229c9cad1058b-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 19:26:26 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-01 19:26:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49750	104.26.5.15	443	7652	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 19:26:26 UTC	261	OUT	GET /demo/home.php?s=149.18.24.96 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-01 19:26:26 UTC	652	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 19:26:26 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC47DEF2:8E14_93878F2E:0050_66329762_B05AC5F:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xPO34zPPB2KYm0TaP02kBI%2BkW0U93k14uOxP0HWY7NNAep8Hw68x3oYx94f4rHvhw33ExLRHtKsCqac0lfyZaN8i2qvhqXDPoMuwnKlFd%2FlDclfDHj51bnTZYw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d229c9caf220cf-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 19:26:26 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-01 19:26:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	104.26.5.15	443	7588	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 19:26:26 UTC	261	OUT	GET /demo/home.php?s=149.18.24.96 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-01 19:26:26 UTC	664	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 19:26:26 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC462B2D:8650_93878F2E:0050_66329762_B09FE2D:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MPRY4OQL2Ku7Djt0YYss%2BIZ2v%2Fr0ko4qZ%2BgbV0bE3lXLwrz%2Fm28ebaEs%2Bplj%2FvwtDA9rx4AVYSNHfN%2BiIyvl2U9VZRBIg%2BcAutWCVX1qzWinUn9owe8DOnOIdg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d229c9dc553b4a-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 19:26:26 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-01 19:26:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	104.26.5.15	443	7576	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 19:26:26 UTC	261	OUT	GET /demo/home.php?s=149.18.24.96 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-01 19:26:26 UTC	654	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 19:26:26 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC47DF6F:75AE_93878F2E:0050_66329762_B09FE2C:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V7cOP2FBGioTR1Ppt5TTBSaodVFfQdtf5gYQOHpP6fOgPbIN8kZdGGQPA%2F6jeZVcSDALQb3klOm47qu91lDJuw7A8WfM0Jv%2F6X7IT%2BqkcfudGlNbnVKh3vjRcw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d229c9cd041fdc-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 19:26:26 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-01 19:26:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49746	34.117.186.192	443	8032	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 19:26:26 UTC	237	OUT	GET /widget/demo/149.18.24.96 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-01 19:26:26 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Wed, 01 May 2024 19:26:26 GMT content-type: application/json; charset=utf-8 Content-Length: 959 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-01 19:26:26 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "149.18.24.96", "data": { "ip": "149.18.24.96", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2024-05-01 19:26:26 UTC	217	IN	Data Raw: 64 64 72 65 73 73 22 3a 20 22 55 53 2c 20 4e 59 2c 20 47 72 65 65 6e 6c 61 77 6e 2c 20 35 35 20 42 72 6f 61 64 77 61 79 2c 20 23 36 38 36 2c 20 31 31 37 34 30 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 6c 6f 67 69 63 77 65 62 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 34 39 2e 31 38 2e 30 2e 30 2f 31 36 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 33 34 37 2d 32 31 32 2d 35 30 34 37 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ddress": "US, NY, Greenlawn, 55 Broadway, #686, 11740", "country": "US", "email": "abuse@logicweb.com", "name": "Abuse", "network": "149.18.0.0/16", "phone": "+1-347-212-5047" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49751	104.26.5.15	443	8032	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 19:26:27 UTC	261	OUT	GET /demo/home.php?s=149.18.24.96 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-01 19:26:27 UTC	656	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 19:26:27 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46AFC8:AA46_93878F2E:0050_66329763_B05AC73:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0o%2FBVKbIgwyY%2Fg0soKNGiuCvxY8LcaRc3TG7b2ZHZAojTMcBB6o6y9NLzqKQMnqnkXrC7Z%2FVcJ7CJ0n68NeJam%2BpbHCN4C7IcZezdtzJkCefO6Bfyosf9yLWWQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d229cc3d026ff7-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 19:26:27 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-01 19:26:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	21:25:18
Start date:	01/05/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe"
Imagebase:	0xdd0000
File size:	3'181'568 bytes
MD5 hash:	8A5AC55FCE35D8A033DED9E56940152A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	21:25:21
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xa80000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:25:21
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:25:21
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xa80000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:25:21
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:25:23
Start date:	01/05/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x950000
File size:	3'181'568 bytes
MD5 hash:	8A5AC55FCE35D8A033DED9E56940152A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:25:23
Start date:	01/05/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x950000
File size:	3'181'568 bytes
MD5 hash:	8A5AC55FCE35D8A033DED9E56940152A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	21:25:30
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x5f0000
File size:	3'181'568 bytes
MD5 hash:	8A5AC55FCE35D8A033DED9E56940152A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	21:25:40
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x5f0000
File size:	3'181'568 bytes
MD5 hash:	8A5AC55FCE35D8A033DED9E56940152A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.3569384353.000000000184B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000B.00000002.3569384353.00000000017A7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000B.00000003.3434983200.0000000001897000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000B.00000002.3570549317.0000000001898000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.2%
Total number of Nodes:	1971
Total number of Limit Nodes:	30

Executed Functions

Function 00E95940 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00E9596A
getaddrinfo.WS2_32(?,?,?,00F56328), ref: 00E959EC
socket.WS2_32(?,?,?), ref: 00E95A0D
connect.WS2_32(00000000,00F26B31,?), ref: 00E95A21
closesocket.WS2_32(00000000), ref: 00E95A2D
FreeAddrInfoW.WS2_32(?), ref: 00E95A3A
WSACleanup.WS2_32 ref: 00E95A40
FreeAddrInfoW.WS2_32(?), ref: 00E95A55

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: 04d3eb5a70bdff0d86f99e1605d4f65c2d2724e770213997d73e5601e0ee996a
Instruction ID: 790201d22fe8292f76e31aace89e2308829877f0fd7852be0d36817a80c03083
Opcode Fuzzy Hash: 04d3eb5a70bdff0d86f99e1605d4f65c2d2724e770213997d73e5601e0ee996a
Instruction Fuzzy Hash: 1C31CF72504704AFDB219F64DC84A6BBBE5FB84738F10171DF8A5A22A0D3719C059B96

Uniqueness

Uniqueness Score: -1.00%

Function 00E94EB0 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(000003DC,0000FFFF,00001006,?,00000008), ref: 00E94F56
recv.WS2_32(?,00000004,00000002), ref: 00E94F71
WSAGetLastError.WS2_32 ref: 00E94F75
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 00E94FF3
recv.WS2_32(00000000,0000000C,00000008), ref: 00E95014
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 00E950B0
recv.WS2_32(00000000,?,00000008), ref: 00E950CB

Part of subcall function 00E95940: WSAStartup.WS2_32 ref: 00E9596A
Part of subcall function 00E95940: getaddrinfo.WS2_32(?,?,?,00F56328), ref: 00E959EC
Part of subcall function 00E95940: socket.WS2_32(?,?,?), ref: 00E95A0D
Part of subcall function 00E95940: connect.WS2_32(00000000,00F26B31,?), ref: 00E95A21
Part of subcall function 00E95940: closesocket.WS2_32(00000000), ref: 00E95A2D
Part of subcall function 00E95940: FreeAddrInfoW.WS2_32(?), ref: 00E95A3A
Part of subcall function 00E95940: WSACleanup.WS2_32 ref: 00E95A40

recv.WS2_32(?,00000004,00000008), ref: 00E951D3
__Xtime_get_ticks.LIBCPMT ref: 00E951DA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E951E8
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 00E95261
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 00E95269

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: 595a4536415b333da24af0aadfd35c36459cd3959689ed7d5a572cfdb5ed92e2
Instruction ID: 092c9a6989e61d6b3a8642379e5b537ac71f1744c58a58e5ae3b13b3f6191059
Opcode Fuzzy Hash: 595a4536415b333da24af0aadfd35c36459cd3959689ed7d5a572cfdb5ed92e2
Instruction Fuzzy Hash: EBB19971D00308DFEF15DFA8CC89BADBBB5AB45304F204219E554BB2E2D7B15984EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00DD9280 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,00F1A4DC,00000000,74D723A0,-00F56880), ref: 00DD96A6
GetProcAddress.KERNEL32(00000000,?), ref: 00DD96B4
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00F1A4DC,00000000,74D723A0,-00F56880), ref: 00DD96C9

Strings

4oST, xrefs: 00DD962C
Ws2_32.dll, xrefs: 00DD969A
4oST, xrefs: 00DD9660

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: 4oST$4oST$Ws2_32.dll
API String ID: 2819740048-1839276265
Opcode ID: 781eac0156d914c3b09e2e0ac13d9232c309c99d85f6b5df622321902601e2ed
Instruction ID: 310340d99f513a24edca36cc7ec39c977f0973be01ea6908d2ee805c68101f22
Opcode Fuzzy Hash: 781eac0156d914c3b09e2e0ac13d9232c309c99d85f6b5df622321902601e2ed
Instruction Fuzzy Hash: FF02F270D04298DFCF25CFA4C8A07EDFBB0EF55310F24428AE4856B686D7715986CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00E19779 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E18E8F: GetConsoleOutputCP.KERNEL32(8B6C80D3,00000000,00000000,?), ref: 00E18EF2

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00E198FE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00E19908

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 1b8a70823b0336accfd9e41db72b6eb1deb8d7f3c0fdc7541e683d122f0b0886
Instruction ID: 02d4ed8d0dd5ade75c27fe85b1a29c6155148703586e273389f90eec41df8bec
Opcode Fuzzy Hash: 1b8a70823b0336accfd9e41db72b6eb1deb8d7f3c0fdc7541e683d122f0b0886
Instruction Fuzzy Hash: 3461B171C04219AFDF15DFA8C894AEEBBB9BF49308F141159E900B7253D732D981CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E18DEF Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00E18CD6,00000000,?,00F47178,0000000C,00E18D92,?,?,?), ref: 00E18E45
GetLastError.KERNEL32(?,00E18CD6,00000000,?,00F47178,0000000C,00E18D92,?,?,?), ref: 00E18E4F

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 05811581548f6e26a4e51f76df340023b948df52edeb86edefe50847954eb149
Instruction ID: 46f64f7d60de25798f39e6dc71a47d46bd1c7bd905535555615427a06453604a
Opcode Fuzzy Hash: 05811581548f6e26a4e51f76df340023b948df52edeb86edefe50847954eb149
Instruction Fuzzy Hash: 74112B337042145BCA256634AE49BFE37898BC2B38F292659FD19B72D2DF319CC18191

Uniqueness

Uniqueness Score: -1.00%

Function 00E1250C Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,?,00E12616,?,?,?,?,?), ref: 00E12548
GetLastError.KERNEL32(?,?,?,?,00E12616,?,?,?,?,?,00000000,?,00000000), ref: 00E12555

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d09e735f90a1fa375f5100cff3b3d9811d9886bc28637ff843ecf24334496b9
Instruction ID: 84a58e763c757a0f6d36714794a6f094de517abab04312598d93faedfdc9e5dd
Opcode Fuzzy Hash: 7d09e735f90a1fa375f5100cff3b3d9811d9886bc28637ff843ecf24334496b9
Instruction Fuzzy Hash: CE012633610209AFCF05CF69DC558DE3B6AEB85324B240248F911AB290E671ED929B91

Uniqueness

Uniqueness Score: -1.00%

Function 00E19F85 Relevance: 2.6, APIs: 2, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000001,?,00E116F4,00E1B0C9,?,?,00E04B2F,?,?,74D723A0,?,?,00DD3522,?,?), ref: 00E19F89
SetLastError.KERNEL32(00000000), ref: 00E1A02B

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 6d5402e941252754abb37eb1e2a038636fed2fdeaa129e20a84057b197d9ccee
Instruction ID: 4d80e2ceefefd900cb86f7b9eda3b6be4b047c823dc5da46e5d2b10cefd955fa
Opcode Fuzzy Hash: 6d5402e941252754abb37eb1e2a038636fed2fdeaa129e20a84057b197d9ccee
Instruction Fuzzy Hash: A21108313053047ED7216B709CD6DFB369DEB2D7AAB182234F516F11B1DB148CCAA161

Uniqueness

Uniqueness Score: -1.00%

Function 00DD32D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00DD331F

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 88e0f75f83d5f9e69285ef2088a1dfdc1055322beeb667a90db4e8c6ac7f301f
Instruction ID: 31c88ef42446d2aff9a3b61aa8ec8b97f0fd077c69212780101f63dd05e53c8d
Opcode Fuzzy Hash: 88e0f75f83d5f9e69285ef2088a1dfdc1055322beeb667a90db4e8c6ac7f301f
Instruction Fuzzy Hash: 65F0E9721001059BDB14AF74E5558E9B3ECEF243A1714097BE88DD7352EF26DA90C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00E1A64C Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001), ref: 00E1A68D

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fed8497f3795c6d8788812c3c2e6fa3557d16e3eeb37034037b5f0640fccc068
Instruction ID: e4ca8f084810808da02d6293b771d6fd155ba2efe2ff1681bcbced3f05a3967c
Opcode Fuzzy Hash: fed8497f3795c6d8788812c3c2e6fa3557d16e3eeb37034037b5f0640fccc068
Instruction Fuzzy Hash: 97F0E9362026256F9B325B629C05BFA3788AF40770B1D6131E819FB1A0DA34DCC086E3

Uniqueness

Uniqueness Score: -1.00%

Function 00E1B086 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?), ref: 00E1B0B8

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 593ac7099f11297d9fffcaaa6d0cc1af15366004e342c9b8014995ba3ada7a9c
Instruction ID: d73217b012ed478a2b7b3f8383422cf2a0b3fd75619ea950193958c4eb9811b3
Opcode Fuzzy Hash: 593ac7099f11297d9fffcaaa6d0cc1af15366004e342c9b8014995ba3ada7a9c
Instruction Fuzzy Hash: B6E03031101614EBE63127759C007DB3689AF453A4B552161EE25F70D1DB258CC091E1

Uniqueness

Uniqueness Score: -1.00%

Function 010CEB8C Relevance: 1.3, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 010CEBB7

Memory Dump Source

Source File: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F77000, based on PE: true

Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1be12d1caf83b60f0602fe2e5e7a4cb46ae84b49669a93ea9a5380673bec1593
Instruction ID: 05faf5022290838a29fa579b4634acf0f8f180dd3094486c5df1fd5517765371
Opcode Fuzzy Hash: 1be12d1caf83b60f0602fe2e5e7a4cb46ae84b49669a93ea9a5380673bec1593
Instruction Fuzzy Hash: BDE0EC753102089BDF50CE8CD884B6F37DDE788610F108425F54AD7205C234E8509B71

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00E9C630 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 240injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 00E9C6A1
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 00E9C6BD
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 00E9C6F2
VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 00E9C71B
WriteProcessMemory.KERNEL32(?,00000000,?,00000218,00000000), ref: 00E9C8BF
WriteProcessMemory.KERNEL32(?,00000218,00E9C990,-00000010,00000000), ref: 00E9C8E1
CreateRemoteThread.KERNEL32(?,00000000,00000000,00000218,00000000,00000000,00000000), ref: 00E9C8F4
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00E9C8FD

Strings

131, xrefs: 00E9C883, 00E9C893
%s|%s, xrefs: 00E9C89F
4oST, xrefs: 00E9C7D2

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite$AllocVirtual$CreateObjectRemoteSingleThreadWait
String ID: %s|%s$131$4oST
API String ID: 2137838514-1634972829
Opcode ID: 319cc17d29ff77864d3d9e194ecb7ba7bbe907b3409a4354ac8121c4b0066479
Instruction ID: 7b9bd0432b5480b5b233e68e0be38864bbe36d1caab200eea64021d7029d7017
Opcode Fuzzy Hash: 319cc17d29ff77864d3d9e194ecb7ba7bbe907b3409a4354ac8121c4b0066479
Instruction Fuzzy Hash: 02B169B1D00208DFDB14CFA8CC85BAEBBB4FF48310F104259E919BB291D775AA45DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00E247AD Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00E249C4

Strings

1#SNAN, xrefs: 00E248B9
1#INF, xrefs: 00E248E3
1#QNAN, xrefs: 00E248C0
1#IND, xrefs: 00E248B2

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: dc255d4e46883e158cca27689527d4976faa2d457a9b1f8ec5c8d79a519759b1
Instruction ID: 4fc8e64b272e1de574007604c9e573489fa8e4a8f924ce3a8872600feb38be0e
Opcode Fuzzy Hash: dc255d4e46883e158cca27689527d4976faa2d457a9b1f8ec5c8d79a519759b1
Instruction Fuzzy Hash: C7D229B2E086288FDB65CE28DD447EAB7B5EB44315F1461EAD40DF7280E774AE818F41

Uniqueness

Uniqueness Score: -1.00%

Function 00E232E1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,00E235F3,?,?), ref: 00E2337A
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,00E235F3,?,?), ref: 00E233A3
GetACP.KERNEL32(?,?,00E235F3,?,?), ref: 00E233B8

Strings

OCP, xrefs: 00E23335
ACP, xrefs: 00E232FF

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 64bd0c35ae3372d81e79fc8950b80491fb577345b9af38bf86bd9eaeee5bfab2
Instruction ID: e6b498b87a7ea56052f6c1c855d3e24667ffd90270ad66a90ec37d2018ec41fd
Opcode Fuzzy Hash: 64bd0c35ae3372d81e79fc8950b80491fb577345b9af38bf86bd9eaeee5bfab2
Instruction Fuzzy Hash: 8121B032600128EAD730CB39F901A9AB3A7BB40F58B569464E926EB100EF36DF41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00E234BD Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E19E32: GetLastError.KERNEL32(00000000,?,00E1F819), ref: 00E19E36
Part of subcall function 00E19E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00E19ED8

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 00E235C5
IsValidCodePage.KERNEL32(?), ref: 00E23603
IsValidLocale.KERNEL32(?,00000001), ref: 00E23616
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00E2365E
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00E23679

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: b6f153f7bad29192d02073851130d0dcb96f33c1113b76eacfe85a71616fed32
Instruction ID: 4156cc30fb0f1f3f59267dca838b714e36a673b68e248217fefafd8406d93920
Opcode Fuzzy Hash: b6f153f7bad29192d02073851130d0dcb96f33c1113b76eacfe85a71616fed32
Instruction Fuzzy Hash: A951AE71A00229ABDB10DFB5EC45ABAB3B9BF08704F141469E914F7190DB78DB449F61

Uniqueness

Uniqueness Score: -1.00%

Function 00E22B48 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E19E32: GetLastError.KERNEL32(00000000,?,00E1F819), ref: 00E19E36
Part of subcall function 00E19E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00E19ED8

GetACP.KERNEL32(?,?,?,?,?,?,00E172F0,?,?,?,?,?,-00000050,?,?,?), ref: 00E22C07
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00E172F0,?,?,?,?,?,-00000050,?,?), ref: 00E22C3E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00E22DA1

Strings

utf8, xrefs: 00E22D10

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: b974de1e043117cdcdef690b0b496fdca48f1bf4faf570c0a23377ab164a6cf4
Instruction ID: ee4959687153d57aff7b5177b62bc622c64b501e78f458de56f964d6323efe01
Opcode Fuzzy Hash: b974de1e043117cdcdef690b0b496fdca48f1bf4faf570c0a23377ab164a6cf4
Instruction Fuzzy Hash: 48711A31600626BADB24AF74EC42BFA73E8EF44714F14652EFA15F7181EB70E9808761

Uniqueness

Uniqueness Score: -1.00%

Function 00E0C950 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d832fe2a0f42001a57c9b2c34ab75cd1b9a187cae735d2738bff895b2773b599
Instruction ID: 76596458c1a1bad4a4597cf7f1269c078bb1c8390ea431c5ec9dba94bfdc369d
Opcode Fuzzy Hash: d832fe2a0f42001a57c9b2c34ab75cd1b9a187cae735d2738bff895b2773b599
Instruction Fuzzy Hash: 53021A71E012199BDB14CFA9D9806AEFBF1FF48318F249269D919F7381D731A981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E22F65 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00E19E32: GetLastError.KERNEL32(00000000,?,00E1F819), ref: 00E19E36
Part of subcall function 00E19E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00E19ED8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E22FB9
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E23003
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E230C9

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: d0aad85fdc434604ad2b129027292c365b1f62e30991811028207fe97d7b26db
Instruction ID: 7ee6b997e56a60f24d139a753bb5874cfeb610ad1e6fb66609d99b7f7fb53e06
Opcode Fuzzy Hash: d0aad85fdc434604ad2b129027292c365b1f62e30991811028207fe97d7b26db
Instruction Fuzzy Hash: E861B071911227DBEB28DF38EC86BAA77A9FF04304F105179E905E6181E738DA91DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00E08A54 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00E08B4C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00E08B56
UnhandledExceptionFilter.KERNEL32(?), ref: 00E08B63

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 162f821211528f8187058131f5af79326e009487070a3c6e8d532b0b2e0cd5af
Instruction ID: d3d8003f9432d3f2d97460bca33d9cbcd3551ed52b07bd1edfba5ab81197970d
Opcode Fuzzy Hash: 162f821211528f8187058131f5af79326e009487070a3c6e8d532b0b2e0cd5af
Instruction Fuzzy Hash: C631C4B590121DABCB21DF68DD8978DBBB8BF08310F5051DAE41CA7290EB749F858F45

Uniqueness

Uniqueness Score: -1.00%

Function 00E01F8C Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,00DED027,?,?,?,00DF4721), ref: 00E01F98
FindFirstFileExW.KERNEL32(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,00DED027,?,?,?,00DF4721), ref: 00E01FC7
GetLastError.KERNEL32(?,00DED027,?,?,?,00DF4721), ref: 00E01FD9

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 6b7457340ce92e5bfd2406ddf3bb7099116bb3fc58814b3f652838c23424b4d1
Instruction ID: 44afede622bdce3d63cfc6e819673dcf5808e794d987ec91d211814057d8e116
Opcode Fuzzy Hash: 6b7457340ce92e5bfd2406ddf3bb7099116bb3fc58814b3f652838c23424b4d1
Instruction Fuzzy Hash: 61F0547120020ABFDB205F65DC049BA7BADEF14370B144524F969D51E0D73189E29661

Uniqueness

Uniqueness Score: -1.00%

Function 00E0360D Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00E03067,?,?,?,?,00E951DF), ref: 00E03645
GetSystemTimeAsFileTime.KERNEL32(?,8B6C80D3,00000000,?,00F1E6F2,000000FF,?,00E03067,?,?,?,?,00E951DF), ref: 00E03649

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 1431d926516859a893cc482f699fe6e89350534eb042d68eca082a1eed75f2c9
Instruction ID: db0136fe4670abc72ae15bebb1e196444b86f4831b9882680b751a5d057cbbdc
Opcode Fuzzy Hash: 1431d926516859a893cc482f699fe6e89350534eb042d68eca082a1eed75f2c9
Instruction Fuzzy Hash: 01F06532944A68EFC711CF54EC01B9AB7A8F708F24F004226E912977D0DB75A900EF81

Uniqueness

Uniqueness Score: -1.00%

Function 7EF70000 Relevance: 2.1, Strings: 1, Instructions: 824COMMON

Download Yara Rule

Strings

cFX, xrefs: 7EF70652

Memory Dump Source

Source File: 00000000.00000002.3573322781.000000007EF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 7EF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ef70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: cFX
API String ID: 0-2631176398
Opcode ID: b4ecc8f9b8b2dbf57254e6ac807cf921b6f13312f38b6c17dbaba6974922cd66
Instruction ID: f7672046d692c859a48ca0eb87f6957610b22f442af74444a9b72ba176388d97
Opcode Fuzzy Hash: b4ecc8f9b8b2dbf57254e6ac807cf921b6f13312f38b6c17dbaba6974922cd66
Instruction Fuzzy Hash: 01429DF3E00210ABF3059A18DCA1BAB76ABDFC4328F95463EE94E67BC0E6745D114791

Uniqueness

Uniqueness Score: -1.00%

Function 00E1DA74 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00E1DA6F,?,?,?,?,?,?,00000000), ref: 00E1DCA1

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0f35da7121c230e302bb1cb9124323c0a5a1fbfa4e8e4136448b90e11d58c788
Instruction ID: c60a9423e95fbfbcc47b4e2df4f9e6707ae3b4b8db994c1fc2754e5b5c600b01
Opcode Fuzzy Hash: 0f35da7121c230e302bb1cb9124323c0a5a1fbfa4e8e4136448b90e11d58c788
Instruction Fuzzy Hash: 25B15E31514608DFD719CF28C88ABA57BE0FF45368F299658E89ADF2A1C375E981CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00E231B8 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00E19E32: GetLastError.KERNEL32(00000000,?,00E1F819), ref: 00E19E36
Part of subcall function 00E19E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00E19ED8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E2320C

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: a73ceaf85151b587444e315ddb92f874a0992730aa8994c059512ce3ab15306f
Instruction ID: 977b197030ff236e751e2498800240708b2669333e070b70651cca6cfc763104
Opcode Fuzzy Hash: a73ceaf85151b587444e315ddb92f874a0992730aa8994c059512ce3ab15306f
Instruction Fuzzy Hash: 85218332511226ABDF289A34EC41ABA77E8EF45314F10217AF901E6151EB79DE41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00E22E3F Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E19E32: GetLastError.KERNEL32(00000000,?,00E1F819), ref: 00E19E36
Part of subcall function 00E19E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00E19ED8

EnumSystemLocalesW.KERNEL32(00E22F65,00000001,00000000,?,?,?,00E23599,?), ref: 00E22EB1

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 23126c8357f633d5b27d6293e1c6737c537e98cadf3a8e995439ea547d56a0ef
Instruction ID: e3b9d515fc0a4f8142fcb4efbb9a7453d635a633ee8e65b588eabd636f06cd9e
Opcode Fuzzy Hash: 23126c8357f633d5b27d6293e1c6737c537e98cadf3a8e995439ea547d56a0ef
Instruction Fuzzy Hash: A5114C372003056FDB289F38E8A15BAB791FF84318B15442DEA8757740D771B943DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00E233E7 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00E19E32: GetLastError.KERNEL32(00000000,?,00E1F819), ref: 00E19E36
Part of subcall function 00E19E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00E19ED8

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00E23262,00000000,00000000,?), ref: 00E23413

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9577d950c221c88402ce25a9be2e676150f0cf3026a108e43e41959c31a5b63b
Instruction ID: 53d2ee26b4b48fa8f80464aeb0962adb0c504eb9253624a4680b2547ab487415
Opcode Fuzzy Hash: 9577d950c221c88402ce25a9be2e676150f0cf3026a108e43e41959c31a5b63b
Instruction Fuzzy Hash: 2401D632A10136BBDF296B34D805AFA37A4EB40758F154568AD56B3180EA38FF42DA90

Uniqueness

Uniqueness Score: -1.00%

Function 00E22D4D Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00E19E32: GetLastError.KERNEL32(00000000,?,00E1F819), ref: 00E19E36
Part of subcall function 00E19E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00E19ED8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00E22DA1

Strings

utf8, xrefs: 00E22D10

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: f1af27ff63d49fbb55cecbe5f097636a1ba93c6eae724fbce1c6c6da808ae0b1
Instruction ID: 8f95c8e8012b6069512a1b801cd70c4c12d6466fe298137e402a84136be3030d
Opcode Fuzzy Hash: f1af27ff63d49fbb55cecbe5f097636a1ba93c6eae724fbce1c6c6da808ae0b1
Instruction Fuzzy Hash: CEF0A432640219ABC714AB74DC55EFA33E8DB45315F11117DB602E7282DA78AE459750

Uniqueness

Uniqueness Score: -1.00%

Function 00E22EDA Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E19E32: GetLastError.KERNEL32(00000000,?,00E1F819), ref: 00E19E36
Part of subcall function 00E19E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00E19ED8

EnumSystemLocalesW.KERNEL32(00E231B8,00000001,?,?,?,?,00E23561,?,?,?,?), ref: 00E22F24

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 5ddffc9bbc9c666363d201cf583f19de937cdbf38c658a159021dfdae4d7b2da
Instruction ID: 731d038ee8cca96495f3236f923b8449a917da7f921718ae4dd5ef33ee6724cb
Opcode Fuzzy Hash: 5ddffc9bbc9c666363d201cf583f19de937cdbf38c658a159021dfdae4d7b2da
Instruction Fuzzy Hash: C0F0F6363003146FDB249F35EC81A7A7BE1FF80768F45842DFA466B680C6719C42DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00E1B1A3 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E1423B: RtlEnterCriticalSection.NTDLL(-00F55967), ref: 00E1424A

EnumSystemLocalesW.KERNEL32(00E1B196,00000001,00F47298,0000000C,00E1B5CB,?,?,?,?), ref: 00E1B1DB

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 43042213a1e7093713fedcc611abff2e61ee63d409e76acd814d8f0ae53f2b62
Instruction ID: c5e4741cb0b8242ff10fb69b5cbb19bf81211fca0fdb595c1aa7bb8ace3e9f1f
Opcode Fuzzy Hash: 43042213a1e7093713fedcc611abff2e61ee63d409e76acd814d8f0ae53f2b62
Instruction Fuzzy Hash: 86F03CB6A04304EFD710DFA8E842B9D77F0EB08721F10915AF511A72E0CBB59A40DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00E22DF4 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E19E32: GetLastError.KERNEL32(00000000,?,00E1F819), ref: 00E19E36
Part of subcall function 00E19E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00E19ED8

EnumSystemLocalesW.KERNEL32(00E22D4D,00000001,?,?,?,00E235BB,?,?,?,?), ref: 00E22E2B

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8851bb467be6170576aae0b0781b0fb0b2452ad9b391ba3b3bd69ba746afa4b5
Instruction ID: 8f3846aaf00a343914d961778a5decfc0223b74b829aad7cbc92494b960b7e53
Opcode Fuzzy Hash: 8851bb467be6170576aae0b0781b0fb0b2452ad9b391ba3b3bd69ba746afa4b5
Instruction Fuzzy Hash: 7EF05536300208A7CB14AF35E84566ABF90EFC1714B07405CEB069B290C6719943DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00E1B726 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,?,?,?,?,00E17E66,?,20001004,?,00000002,?,?,00E17458), ref: 00E1B75A

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: db8438de162482c0ce41b9491562b856d4b73d91b44e9c940abb05ba87245e5e
Instruction ID: 2778e4d88e8131f814acf7e0ee98037350c0b1a453f4381306de0d7670dfec2a
Opcode Fuzzy Hash: db8438de162482c0ce41b9491562b856d4b73d91b44e9c940abb05ba87245e5e
Instruction Fuzzy Hash: BAE04F3150061CBBCF123F60DC08ADE3E6AEF85761F004111FD15791B0CB729D61AA95

Uniqueness

Uniqueness Score: -1.00%

Function 00EC0350 Relevance: .7, Instructions: 735COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 119a76eaf56a1b3b0f6a99f694ecaa4c4c6e659e641367f6b8bb49a398108aa4
Instruction ID: e5c88777f9ef8546e6cd7cc1f8cf985237f621c1653b994d969ff0c1c53a6aa7
Opcode Fuzzy Hash: 119a76eaf56a1b3b0f6a99f694ecaa4c4c6e659e641367f6b8bb49a398108aa4
Instruction Fuzzy Hash: A4623DB1E00215DBDB18CF59C684BAEBBB1AF89308F2491ADD8546B342C776D947CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00DFF570 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2deecbe3ee60a011d5856fdee5848cba5150375c33bcb85bf53e5887f2a007a
Instruction ID: 5a610474a9aa9fa5ce77e2e1dd9125746c3bedec7eb153c7c74954e58f82a786
Opcode Fuzzy Hash: c2deecbe3ee60a011d5856fdee5848cba5150375c33bcb85bf53e5887f2a007a
Instruction Fuzzy Hash: 82E10376E1022A9FCB05CFA8D4816ADFBF1FF88314F1A8169D955B7340D670AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 7EF70B2E Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3573322781.000000007EF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 7EF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ef70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64672be9002899b88d69f017a98ddee900fd1562fe9ab500d4cf41606b8ad88a
Instruction ID: 58bfee70e68fed7894076275a0937a627c22a606eef68dae2caf51ce750460fc
Opcode Fuzzy Hash: 64672be9002899b88d69f017a98ddee900fd1562fe9ab500d4cf41606b8ad88a
Instruction Fuzzy Hash: B6A1CCB3E40210ABF309991CDCA5BAB76ABDFC0328F95423EE94E67BC4E5B45D0046D1

Uniqueness

Uniqueness Score: -1.00%

Function 00E1035F Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b5ad033fe52656108c09b3030615d696873ff3ea0324bdcff6cb30501b8e3a5
Instruction ID: 91e8cb19ea7d03fe46257e7ef5cac1168050d9728170d83d4a1bf1c9b70feb7d
Opcode Fuzzy Hash: 9b5ad033fe52656108c09b3030615d696873ff3ea0324bdcff6cb30501b8e3a5
Instruction Fuzzy Hash: BDC1EB7090070A8FCB34CF68C4846FABBB2BF45318F146619D5A6BB691C7B0ADC5CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00E225FE Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f71c984573f32e108c37335478c0576313722ec08cb495d6c1ce5c8cf9173d5e
Instruction ID: 1adb214c8775166cc6bec8153025ed0c4991d1cf796508e66d41e60b3ac3e13f
Opcode Fuzzy Hash: f71c984573f32e108c37335478c0576313722ec08cb495d6c1ce5c8cf9173d5e
Instruction Fuzzy Hash: 70B10635500716ABDB3C9B24DC92BB7B3E8FF54308F14556EEB82E6580EA74E985CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00E28BA0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b060102fc4ec6d92760ee00998116279f17137bd25b96cfb86d11c9e22be16
Instruction ID: 2287989c8d172e339bbbc033e8f39e6715ab74b7d12e945bbd442e26aa638d70
Opcode Fuzzy Hash: 37b060102fc4ec6d92760ee00998116279f17137bd25b96cfb86d11c9e22be16
Instruction Fuzzy Hash: 1A8103B0D022668FDB108F58E9817BEFBF4EB19308F441169D955E7383CB349909D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EBCFC0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3fb824efe76ed0abf6610fe7a453b7b0c3e3d9498802f6daaa992099d6cbb3b
Instruction ID: 60d464f89adf0bbecc22858d758afc8676f4712ac8716e62369f510dce9d38e1
Opcode Fuzzy Hash: e3fb824efe76ed0abf6610fe7a453b7b0c3e3d9498802f6daaa992099d6cbb3b
Instruction Fuzzy Hash: 166162316205684FEB18CF5EFCD046A7F53A38A3213854229EA81DB295C635F926E7E4

Uniqueness

Uniqueness Score: -1.00%

Function 00E0A918 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46680d0314554fd398ed7fd020ff60bee8df1d437ae882661bd78aeb1168d151
Instruction ID: c05b0ea42e37e86907ec5155685d12cd1dc5a9e2b36f996e0e61e6f4dbf4a53a
Opcode Fuzzy Hash: 46680d0314554fd398ed7fd020ff60bee8df1d437ae882661bd78aeb1168d151
Instruction Fuzzy Hash: 80517372E00219EFDF14CF94C941AEEBBB2FF88304F598469E555BB241D7749A80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E07190 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 03cd28124916ce49d0bc2455c57a178e1c409bf1094b6405f058645c5ac32d0a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 96112BF7A0E09143D614863DE8B46B7A795EBD532872C637AD0C16BBD8D122F9C5DA00

Uniqueness

Uniqueness Score: -1.00%

Function 7EF71E20 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3573322781.000000007EF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 7EF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ef70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f62f68f05798d32491e71e5a3bd33828f17dbbcbaf8b34fab85e42735d4f1cb
Instruction ID: eefc851bb99f223ad8551cc5dd88e7741580b9aef85611b8d58374e0b856f005
Opcode Fuzzy Hash: 8f62f68f05798d32491e71e5a3bd33828f17dbbcbaf8b34fab85e42735d4f1cb
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00E279D3 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 00E279EC

Strings

asin, xrefs: 00E27B19
log, xrefs: 00E27A49, 00E27A58
acos, xrefs: 00E27B22
sqrt, xrefs: 00E27B2B
exp, xrefs: 00E27A6B, 00E27AD0
pow, xrefs: 00E27A8A, 00E27B34, 00E27B81
log10, xrefs: 00E27A2E, 00E27A3D

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: b93726a2be3ff01c0fb60f65458d4dc06999a5791e2568adafc614469b099311
Instruction ID: d9d77e4168f2ddf84e621df2c1bf1402c424030991bfdc99bf254e6ae6f77caf
Opcode Fuzzy Hash: b93726a2be3ff01c0fb60f65458d4dc06999a5791e2568adafc614469b099311
Instruction Fuzzy Hash: EA519DB090862ECBDF109FA8F8481EDBFB1FB05318FA45184D8C1B7268CB718A65DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00E072C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00E072F7
___except_validate_context_record.LIBVCRUNTIME ref: 00E072FF
_ValidateLocalCookies.LIBCMT ref: 00E07388
__IsNonwritableInCurrentImage.LIBCMT ref: 00E073B3
_ValidateLocalCookies.LIBCMT ref: 00E07408

Strings

W, xrefs: 00E073A5, 00E073AE, 00E073BF
csm, xrefs: 00E0739D

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$W
API String ID: 1170836740-1260979217
Opcode ID: 74f002a87f1135b3a203035cc65990d46ede489dc2036d2480d70402aafc9f47
Instruction ID: 86708a1833c010d2ad547076d6212520b1515ea043f1ee0334425177dd67bfe0
Opcode Fuzzy Hash: 74f002a87f1135b3a203035cc65990d46ede489dc2036d2480d70402aafc9f47
Instruction Fuzzy Hash: 1841D330E0420A9BCF10DF68C880A9EBBE5AF44318F149155EC98BB3D2D735ED85DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E1BB58 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00E1BBDE

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 88e4da6258101c5fc24b34185784eb547dfa0330ad300027970d950eece25734
Instruction ID: 081c37b30590dbfd5e49715b8b132fc092fe69808636db90a962e33136134ace
Opcode Fuzzy Hash: 88e4da6258101c5fc24b34185784eb547dfa0330ad300027970d950eece25734
Instruction Fuzzy Hash: 45B15772A003659FDB258F24CC82BEEBBE5EF59314F146156E904BF282D774D981C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00E1B370 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00E1B47F,?,?,00000000,00000001,?,?,00E1B6A9,00000022,FlsSetValue,00F2EB88,00F2EB90,00000001), ref: 00E1B431

Strings

api-ms-, xrefs: 00E1B3C7
ext-ms-, xrefs: 00E1B3DB

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 85d1d725ae103e883a98013e0cf0a1551e5b43161257aad853a9772e915ae13f
Instruction ID: 4d90794b35bb7bc8ece5272dc9a2373e2ab798302156b58b7feca2c89d69cc60
Opcode Fuzzy Hash: 85d1d725ae103e883a98013e0cf0a1551e5b43161257aad853a9772e915ae13f
Instruction Fuzzy Hash: 1B213A32A01215ABCB31AB31DC42ADE3758DF41764F245124F925B7292EB70EE91D6D1

Uniqueness

Uniqueness Score: -1.00%

Function 00E952A0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 399COMMON

Download Yara Rule

Strings

4oST, xrefs: 00E95451
4oST, xrefs: 00E9552A
149.18.24.96, xrefs: 00E95328
4oST, xrefs: 00E955B5

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 149.18.24.96$4oST$4oST$4oST
API String ID: 0-608211275
Opcode ID: 5daa8fc147ac5d547e5c3810b9d40e86c838169e77019e4fe87d8fc7b2df95db
Instruction ID: 60034e9115593c28177583dda269ca179c9ae59dbc2b2acf6a7babec912d498c
Opcode Fuzzy Hash: 5daa8fc147ac5d547e5c3810b9d40e86c838169e77019e4fe87d8fc7b2df95db
Instruction Fuzzy Hash: A802FD70D04288DEDF15EFA8C9457DDBBB0EB14308F5441A9D809BB382D7B55E88DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DEA060 Relevance: 9.1, APIs: 6, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00DEA09D
std::_Lockit::_Lockit.LIBCPMT ref: 00DEA0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 00DEA0E7
__Getctype.LIBCPMT ref: 00DEA1C5
std::_Facet_Register.LIBCPMT ref: 00DEA1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 00DEA223

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 6552424294086cef81c3e391750fb9cd1d124e24646f74e64c28fcdbaaee52ca
Instruction ID: 936b68f2c39b59bc4ef118f14fac8c03bc2cb77b98c0da20caf9e7310c0d6a27
Opcode Fuzzy Hash: 6552424294086cef81c3e391750fb9cd1d124e24646f74e64c28fcdbaaee52ca
Instruction Fuzzy Hash: EC51C8B0D0078ACBDB11DF58C9457AEBBF0BB10710F18825DE955AB381D774AA44DBE2

Uniqueness

Uniqueness Score: -1.00%

Function 00E13623 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8B6C80D3,?,?,00000000,00F1E6D5,000000FF,?,00E135FF,?,?,00E135D3,00000016), ref: 00E13658
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E1366A
FreeLibrary.KERNEL32(00000000,?,00000000,00F1E6D5,000000FF,?,00E135FF,?,?,00E135D3,00000016), ref: 00E1368C

Strings

mscoree.dll, xrefs: 00E13651
CorExitProcess, xrefs: 00E13662

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ac525cad754ccc035df7ffe882faebacaefedd1d7bb7bd5d1bb0a4f0d3a09e18
Instruction ID: 0a9d71b89e8ee88a33c6f8331f4d729789aff34d3da976c5bbdb05b138d23d01
Opcode Fuzzy Hash: ac525cad754ccc035df7ffe882faebacaefedd1d7bb7bd5d1bb0a4f0d3a09e18
Instruction Fuzzy Hash: 5301A23194472DEFCB118F54DC09BAEBBB8FB04B15F004229E812A26E0DBB49A40DA41

Uniqueness

Uniqueness Score: -1.00%

Function 00DEC430 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00DEC45A
std::_Lockit::_Lockit.LIBCPMT ref: 00DEC47C
std::_Lockit::~_Lockit.LIBCPMT ref: 00DEC4A4
std::_Facet_Register.LIBCPMT ref: 00DEC59A
std::_Lockit::~_Lockit.LIBCPMT ref: 00DEC5C4

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: e3b1749d2ee35b909136e163183dc8dc9bb7f13e9ca223c4b64c2b10cbd7e26c
Instruction ID: 1adee2d45bd278cc82768f153e782200f06e7cb62dbf52252b3cc079219082c2
Opcode Fuzzy Hash: e3b1749d2ee35b909136e163183dc8dc9bb7f13e9ca223c4b64c2b10cbd7e26c
Instruction Fuzzy Hash: 2551ECB0900288DBDB10EF58C848BAEBBF0FF00314F24814CE855AB381D775AA42DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E02BB8 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00E02BCC
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00E02BEB
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00E02C19
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00E02C74
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00E02C8B

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 500cb6481ba38f6cf58655a2bc3415121dd460565b403fa34062ac6dab48c41b
Instruction ID: 3799f88ec5714c99a8dd8f55d1fb1100ec529c4d0e5ffa924c513b18c48f493d
Opcode Fuzzy Hash: 500cb6481ba38f6cf58655a2bc3415121dd460565b403fa34062ac6dab48c41b
Instruction Fuzzy Hash: C5413730900A0ADBEB21CF65C4C89AEF3F8FF08354B60592DE656A7680D731E9C5DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DD4900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00DD499F

Part of subcall function 00E051EB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00E01CF9,?,00F469D8,74D723A0,?,74D723A0,-00F56880), ref: 00E0524B

Strings

ios_base::eofbit set, xrefs: 00DD4946
ios_base::badbit set, xrefs: 00DD4937, 00DD4962
ios_base::failbit set, xrefs: 00DD4828, 00DD4941

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-1866435925
Opcode ID: c623bfe3be7fcd41f1a64413af6d5adcae40c93d5848e7fad18d73847bffe8c0
Instruction ID: 1d4db52ea349760842be3f371b1588d450b4b6fe4c8ce7b2a46fdfdde4d8f24c
Opcode Fuzzy Hash: c623bfe3be7fcd41f1a64413af6d5adcae40c93d5848e7fad18d73847bffe8c0
Instruction Fuzzy Hash: 54112972908A446BCB10DF59DC16B9673DCDB05720F44462EFE68973C2EB35A900DBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00E18E8F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8B6C80D3,00000000,00000000,?), ref: 00E18EF2

Part of subcall function 00E1EC43: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00E1A854,?,00000000,-00000008), ref: 00E1ECA4

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00E19144
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00E1918A
GetLastError.KERNEL32 ref: 00E1922D

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 286f3ad11170bda5cb600dbb27d8add07ecba8dd69dccdec4de6ec151e14b3f7
Instruction ID: 195644f50333f2686b196c0682c1abcd713c9d5cb9b4da8629bef1e4f85b0c15
Opcode Fuzzy Hash: 286f3ad11170bda5cb600dbb27d8add07ecba8dd69dccdec4de6ec151e14b3f7
Instruction Fuzzy Hash: EAD18D75E04248AFCF15CFA8D894AEDBBB5FF09314F24452AE519FB352D630A982CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00E02719 Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00E02720
std::_Lockit::_Lockit.LIBCPMT ref: 00E0272B
std::_Lockit::~_Lockit.LIBCPMT ref: 00E02799

Part of subcall function 00E0287C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00E02894

std::locale::_Setgloballocale.LIBCPMT ref: 00E02746

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: 2426054c8f62ac40357f5b4f12ab2c95bb18b003db6f1cf9e191c2b307e8142a
Instruction ID: a4b600b2839d38f9acc4f2d03828d0c2a37b65195a45bfcd800a7df0b03bf467
Opcode Fuzzy Hash: 2426054c8f62ac40357f5b4f12ab2c95bb18b003db6f1cf9e191c2b307e8142a
Instruction Fuzzy Hash: E901FC35A006158BCB0AEB30C84957D77F1FF80B80B08500DEA11633C1CF74AE82EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00E26D22 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000,?,?,00E23DBC,?,00000001,?,?,?,00E19281,?,00000000,00000000), ref: 00E26D39
GetLastError.KERNEL32(?,00E23DBC,?,00000001,?,?,?,00E19281,?,00000000,00000000,?,?,?,00E1985B,?), ref: 00E26D45

Part of subcall function 00E26D0B: CloseHandle.KERNEL32(FFFFFFFE,00E26D55,?,00E23DBC,?,00000001,?,?,?,00E19281,?,00000000,00000000,?,?), ref: 00E26D1B

___initconout.LIBCMT ref: 00E26D55

Part of subcall function 00E26CCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00E26CFC,00E23DA9,?,?,00E19281,?,00000000,00000000,?), ref: 00E26CE0

WriteConsoleW.KERNEL32(?,?,?,00000000,?,00E23DBC,?,00000001,?,?,?,00E19281,?,00000000,00000000,?), ref: 00E26D6A

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 73b75b8b1910239769745b5902f5312bc74f528f65a167ab6fbb7f4fcf56847c
Instruction ID: dd436c6b00829efc312b8fb92cb3afaaadb8fd5738f8825abeb1fe7d572287a6
Opcode Fuzzy Hash: 73b75b8b1910239769745b5902f5312bc74f528f65a167ab6fbb7f4fcf56847c
Instruction Fuzzy Hash: F0F0C03654016DBBCF232F95EC15A993F66FB497A1F055514FA1C95130D7328C20EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00DD7350 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00DD750C
___std_exception_destroy.LIBVCRUNTIME ref: 00DD7522

Strings

[json.exception., xrefs: 00DD73A1

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 7c2686a8febe010584c46794779248bfc97e9ab179bb2abd5ee15dd94175c1bf
Instruction ID: e48670c362f94ec78088bc649e3c69c5ccd34aa9794880ba6a7e5c0334c5393d
Opcode Fuzzy Hash: 7c2686a8febe010584c46794779248bfc97e9ab179bb2abd5ee15dd94175c1bf
Instruction Fuzzy Hash: 7C51CFB0C046889FDB00DFA8C945B9EFBB4EF11314F144299E850A73C2E7B85A44DBE2

Uniqueness

Uniqueness Score: -1.00%

Function 00DD47F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00DD499F

Part of subcall function 00E051EB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00E01CF9,?,00F469D8,74D723A0,?,74D723A0,-00F56880), ref: 00E0524B

Strings

ios_base::badbit set, xrefs: 00DD4937, 00DD4962
ios_base::failbit set, xrefs: 00DD4828

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 1903096808-1240500531
Opcode ID: 8d2271974305dd7af14b9c266c3abbe591de1854fba7bfe4ca77d02cbac21b51
Instruction ID: 057f5db2caf2e7c4ac2c1508a9d89367d63459d915e084f7abf1f3106c0445c3
Opcode Fuzzy Hash: 8d2271974305dd7af14b9c266c3abbe591de1854fba7bfe4ca77d02cbac21b51
Instruction Fuzzy Hash: A44112B1904648ABCB04DF58CC46BAEBBF8EF05710F24825EF554A73C2D7759A40DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DD4040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00DD4061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00DD40C4

Strings

bad locale name, xrefs: 00DD40E6

Memory Dump Source

Source File: 00000000.00000002.3568956128.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.3568906972.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568956128.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569345905.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000000F77000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001108000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3569479670.0000000001702000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 9d79c90b84f0127bdd43542d943594a53fd33364186783869dd342dc6a836cb8
Instruction ID: 566cabeb9b391ac986492b1a9f33faa37f644ace2e0d8950861afa7444c3685d
Opcode Fuzzy Hash: 9d79c90b84f0127bdd43542d943594a53fd33364186783869dd342dc6a836cb8
Instruction Fuzzy Hash: CA11BE70805B84EED321CF68C50874BBFF4AF15714F148A9DE49597B81D3B9AA04DBA2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MPGPH131.exePID: 7576, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1913
Total number of Limit Nodes:	34

Executed Functions

Function 00A14EB0 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(000003C8,0000FFFF,00001006,?,00000008), ref: 00A14F56
recv.WS2_32(?,00000004,00000002), ref: 00A14F71
WSAGetLastError.WS2_32 ref: 00A14F75
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 00A14FF3
recv.WS2_32(00000000,0000000C,00000008), ref: 00A15014
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 00A150B0
recv.WS2_32(00000000,?,00000008), ref: 00A150CB

Part of subcall function 00A15940: WSAStartup.WS2_32 ref: 00A1596A
Part of subcall function 00A15940: getaddrinfo.WS2_32(?,?,?,00AD6328), ref: 00A159EC
Part of subcall function 00A15940: socket.WS2_32(?,?,?), ref: 00A15A0D
Part of subcall function 00A15940: connect.WS2_32(00000000,00AA6B31,?), ref: 00A15A21
Part of subcall function 00A15940: closesocket.WS2_32(00000000), ref: 00A15A2D
Part of subcall function 00A15940: FreeAddrInfoW.WS2_32(?), ref: 00A15A3A
Part of subcall function 00A15940: WSACleanup.WS2_32 ref: 00A15A40

recv.WS2_32(?,00000004,00000008), ref: 00A151D3
__Xtime_get_ticks.LIBCPMT ref: 00A151DA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A151E8
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 00A15261
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 00A15269

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: cb1d670877d2d2634ab2d82de760fbd0ba15ac7b9efda9953855bd41ac813bdd
Instruction ID: 3bb2461b908193de92ff72af58803b1dcaf47e776540cfbb1b9ea2ff707b2389
Opcode Fuzzy Hash: cb1d670877d2d2634ab2d82de760fbd0ba15ac7b9efda9953855bd41ac813bdd
Instruction Fuzzy Hash: ACB18B71D00308DFEB15DFA8CC49BEDBBB5BB95300F24421AE455AB2D2D7B05985DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00A15940 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00A1596A
getaddrinfo.WS2_32(?,?,?,00AD6328), ref: 00A159EC
socket.WS2_32(?,?,?), ref: 00A15A0D
connect.WS2_32(00000000,00AA6B31,?), ref: 00A15A21
closesocket.WS2_32(00000000), ref: 00A15A2D
FreeAddrInfoW.WS2_32(?), ref: 00A15A3A
WSACleanup.WS2_32 ref: 00A15A40
FreeAddrInfoW.WS2_32(?), ref: 00A15A55

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: c1f23428d9ca26f6003fd3121d9a0615f8aaeb1dd6fe9b90b5bafc33ed966536
Instruction ID: 72e59fa13e58c42bc80903afa412f0c6118dd9d8ac895212614c70705214e255
Opcode Fuzzy Hash: c1f23428d9ca26f6003fd3121d9a0615f8aaeb1dd6fe9b90b5bafc33ed966536
Instruction Fuzzy Hash: EB31CE76904700ABD720DF74DC88A6ABBE5BF85374F144719F8A9961E0D3309845CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00959280 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,00A9A4DC,00000000,74D723A0,-00AD6880), ref: 009596A6
GetProcAddress.KERNEL32(00000000,?), ref: 009596B4
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00A9A4DC,00000000,74D723A0,-00AD6880), ref: 009596C9

Strings

Ws2_32.dll, xrefs: 0095969A
4oST, xrefs: 0095962C
4oST, xrefs: 00959660

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: 4oST$4oST$Ws2_32.dll
API String ID: 2819740048-1839276265
Opcode ID: 01acfe58d7ddc1c516b517dfaf33705e77e0733efc61bdd9c40a6e6e34e40756
Instruction ID: 106a5617bc7ecef934a33f18632718286e4fdccfd3721531f987265eff650645
Opcode Fuzzy Hash: 01acfe58d7ddc1c516b517dfaf33705e77e0733efc61bdd9c40a6e6e34e40756
Instruction Fuzzy Hash: 8502EF70D04298DFDF25CFA4C8907ADBBB0FF55314F244289E8856B686D774198ACF92

Uniqueness

Uniqueness Score: -1.00%

Function 00999779 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00998E8F: GetConsoleOutputCP.KERNEL32(9A0D8E66,00000000,00000000,?), ref: 00998EF2

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009998FE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00999908

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 3c3ebaac4112aa3dc8c82613a53bfcb71e73b30bdc8a74f059ec8cadae7dfeb1
Instruction ID: 5172a3475b726c09966dcc9de5aa57059a5d15c523ce1b6aed31572088391e47
Opcode Fuzzy Hash: 3c3ebaac4112aa3dc8c82613a53bfcb71e73b30bdc8a74f059ec8cadae7dfeb1
Instruction Fuzzy Hash: 7A61B171C0411AAFDF11DFACC884AEEBBB9AF4A304F18054DE900A7256D736D941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00998DEF Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00998CD6,00000000,?,00AC7178,0000000C,00998D92,?,?,?), ref: 00998E45
GetLastError.KERNEL32(?,00998CD6,00000000,?,00AC7178,0000000C,00998D92,?,?,?), ref: 00998E4F

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: f57da5201e89efa948f1803125ec02dae3a2772832bdbe7b061fb8820b4f7bf8
Instruction ID: 3ca758f95e4a304da1a5a78a98ec607a8051bc523ba9d302bbfb6622e39c7705
Opcode Fuzzy Hash: f57da5201e89efa948f1803125ec02dae3a2772832bdbe7b061fb8820b4f7bf8
Instruction Fuzzy Hash: 27110832A142105ADE26BAFCAC59B7F278D8BC3734F29065DF919972D2DF219C818191

Uniqueness

Uniqueness Score: -1.00%

Function 0099250C Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,?,00992616,?,?,?,?,?), ref: 00992548
GetLastError.KERNEL32(?,?,?,?,00992616,?,?,?,?,?,00000000,?,00000000), ref: 00992555

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0abbb72c5aeefd9bbfdd6f6f42e87f21a16005abe0e8911c2e8a9a23e84dac45
Instruction ID: 0c70c042d466dcd76196c4adbcb829d3c92fefb935c53c8986530b0975581944
Opcode Fuzzy Hash: 0abbb72c5aeefd9bbfdd6f6f42e87f21a16005abe0e8911c2e8a9a23e84dac45
Instruction Fuzzy Hash: 3001C432610515BFCF09CF69DC159AE3B69EB85320B250208F8119B290E671ED52CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009532D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0095331F

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 88e0f75f83d5f9e69285ef2088a1dfdc1055322beeb667a90db4e8c6ac7f301f
Instruction ID: 6fdb47c5ac49e54f347aea3f6d129290e52db4a6ef10108fb6f58720a3134ab4
Opcode Fuzzy Hash: 88e0f75f83d5f9e69285ef2088a1dfdc1055322beeb667a90db4e8c6ac7f301f
Instruction Fuzzy Hash: D5F0BB711001049BCB14BF65D4159E9B3ECDF543D2750857AEC8DC7212FB36DA548790

Uniqueness

Uniqueness Score: -1.00%

Function 0099A64C Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001), ref: 0099A68D

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3c9d2c3607db7cb1f3efa9b85f924e21c95b0eb4cf1bff84d269e929258fbedd
Instruction ID: 8f4b3fd6da07a9a65d030053f0d63573deae6003328e135aa6a4c7cef8a310b9
Opcode Fuzzy Hash: 3c9d2c3607db7cb1f3efa9b85f924e21c95b0eb4cf1bff84d269e929258fbedd
Instruction Fuzzy Hash: 30F089336116256BEF225B6FDC05B5B374DEF92770B1D8112E809DA1A0DB34DC0186E6

Uniqueness

Uniqueness Score: -1.00%

Function 0099B086 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?), ref: 0099B0B8

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8b05ab11a9257f0ffc88b8b685391e940728f0bbeb7de58aff77dfc3d50e973f
Instruction ID: bd6261fb7de39da447976367b093bd3688e7820e7bfc2c9f6c2d0231a173a8bc
Opcode Fuzzy Hash: 8b05ab11a9257f0ffc88b8b685391e940728f0bbeb7de58aff77dfc3d50e973f
Instruction Fuzzy Hash: C7E06D316016216BEE312BAEFE04B5F364DAF823A0F150125FD29E70D5DB2DDC0082E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A1C630 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 240injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 00A1C6A1
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 00A1C6BD
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 00A1C6F2
VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 00A1C71B
WriteProcessMemory.KERNEL32(?,00000000,?,00000218,00000000), ref: 00A1C8BF
WriteProcessMemory.KERNEL32(?,00000218,00A1C990,-00000010,00000000), ref: 00A1C8E1
CreateRemoteThread.KERNEL32(?,00000000,00000000,00000218,00000000,00000000,00000000), ref: 00A1C8F4
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00A1C8FD

Strings

131, xrefs: 00A1C883, 00A1C893
%s|%s, xrefs: 00A1C89F
4oST, xrefs: 00A1C7D2

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: MemoryProcessWrite$AllocVirtual$CreateObjectRemoteSingleThreadWait
String ID: %s|%s$131$4oST
API String ID: 2137838514-1634972829
Opcode ID: 6b11d5fb82952678321389a7154d2c837a9af193c08aefa0415ab425549ecd96
Instruction ID: 9fc06e28fcefd7f3dab7efc937a8d73789dfc8d6010d4a3f176fb793bf33002c
Opcode Fuzzy Hash: 6b11d5fb82952678321389a7154d2c837a9af193c08aefa0415ab425549ecd96
Instruction Fuzzy Hash: DEB169B1D002089FDB14CFA4CC85BEEBBB1FF48310F104259E549AB291D775AA85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 009A32E1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,009A35F3,?,?), ref: 009A337A
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,009A35F3,?,?), ref: 009A33A3
GetACP.KERNEL32(?,?,009A35F3,?,?), ref: 009A33B8

Strings

ACP, xrefs: 009A32FF
OCP, xrefs: 009A3335

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8a72cdb63c62accd318503721ebe4564ed29f88a73129d630e20df655d3c72b4
Instruction ID: 7ed824a55a06018cdc24b6dfc1748fae4a84cb78f1d33b3e99038aec0305343e
Opcode Fuzzy Hash: 8a72cdb63c62accd318503721ebe4564ed29f88a73129d630e20df655d3c72b4
Instruction Fuzzy Hash: 8421A132608105AADF348F59D905B9B73AAAF52B50BD6C524F906DB150EF32DF41C3D0

Uniqueness

Uniqueness Score: -1.00%

Function 009A34BD Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00999E32: GetLastError.KERNEL32(00000000,?,0099F819), ref: 00999E36
Part of subcall function 00999E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00999ED8

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 009A35C5
IsValidCodePage.KERNEL32(?), ref: 009A3603
IsValidLocale.KERNEL32(?,00000001), ref: 009A3616
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 009A365E
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 009A3679

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 05942d18241a67f2866d612c7272348ae445fdaad66960f5cc8b78f3711c31e2
Instruction ID: 46131206798311c67b51aa247079fbc17fe4f88a0dd2e578e8e6868e170b812c
Opcode Fuzzy Hash: 05942d18241a67f2866d612c7272348ae445fdaad66960f5cc8b78f3711c31e2
Instruction Fuzzy Hash: 8F514F71E00206AFDB10DFA9DC45BBA77B8EF4A700F148469B915EB191EB70DA44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009A2B48 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00999E32: GetLastError.KERNEL32(00000000,?,0099F819), ref: 00999E36
Part of subcall function 00999E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00999ED8

GetACP.KERNEL32(?,?,?,?,?,?,009972F0,?,?,?,?,?,-00000050,?,?,?), ref: 009A2C07
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,009972F0,?,?,?,?,?,-00000050,?,?), ref: 009A2C3E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 009A2DA1

Strings

utf8, xrefs: 009A2D10

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 7102289a83dc41624b67b6dd821761cf539dec600520880eb3b5466469f6b5b7
Instruction ID: 7636616035ffa846e2d79823757621326088d1bc1fc548aa69116660d10f6999
Opcode Fuzzy Hash: 7102289a83dc41624b67b6dd821761cf539dec600520880eb3b5466469f6b5b7
Instruction Fuzzy Hash: 8F71E675600306AADB24AF7CCC46BBA73ACEF46710F14496AF945DB1C2EB74E94187E0

Uniqueness

Uniqueness Score: -1.00%

Function 0098C950 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d832fe2a0f42001a57c9b2c34ab75cd1b9a187cae735d2738bff895b2773b599
Instruction ID: 1fef4ad94d06fa0401d1450b479c981d5eb3380a4d3a0c3779392ed6a9507fc6
Opcode Fuzzy Hash: d832fe2a0f42001a57c9b2c34ab75cd1b9a187cae735d2738bff895b2773b599
Instruction Fuzzy Hash: 6C022CB1E012199BDF14DFA9D8806AEFBF5FF48314F248269E919E7381D731A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 009A79D3 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 009A79EC

Strings

acos, xrefs: 009A7B22
exp, xrefs: 009A7A6B, 009A7AD0
log10, xrefs: 009A7A2E, 009A7A3D
asin, xrefs: 009A7B19
sqrt, xrefs: 009A7B2B
log, xrefs: 009A7A49, 009A7A58
pow, xrefs: 009A7A8A, 009A7B34, 009A7B81

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: b94d92d4c896a4e4556b8ace7e140cac47d94f04e344e1c231aff12f86413431
Instruction ID: 4471d6d2dea7e4cb852bd723ee08abc4c214f1c785bd92a2cedba18b6bc26b4d
Opcode Fuzzy Hash: b94d92d4c896a4e4556b8ace7e140cac47d94f04e344e1c231aff12f86413431
Instruction Fuzzy Hash: F5518CB090860ADBDF108FE8EC491ADFFB8FB47310F554585D481AB2A4C7788A25CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0099BB58 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0099BBDE

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 88e4da6258101c5fc24b34185784eb547dfa0330ad300027970d950eece25734
Instruction ID: aae61f5169a5cfa6498d5ca0ed361b3028dc3b30afa7475634b63310d1c618e3
Opcode Fuzzy Hash: 88e4da6258101c5fc24b34185784eb547dfa0330ad300027970d950eece25734
Instruction Fuzzy Hash: 33B14672E00355AFEF218F6CDD81BEE7BA9EF55310F144155E944AF282E7789901C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 009872C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009872F7
___except_validate_context_record.LIBVCRUNTIME ref: 009872FF
_ValidateLocalCookies.LIBCMT ref: 00987388
__IsNonwritableInCurrentImage.LIBCMT ref: 009873B3
_ValidateLocalCookies.LIBCMT ref: 00987408

Strings

csm, xrefs: 0098739D

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 39cabb8ec6165f5d07af30a71d1aa6268b6f6d84af06596429af6e0903cc7cfc
Instruction ID: cc53102c2690cefdcc35962878267be9f61d80053e88fb81900062deb119c5ef
Opcode Fuzzy Hash: 39cabb8ec6165f5d07af30a71d1aa6268b6f6d84af06596429af6e0903cc7cfc
Instruction Fuzzy Hash: 3F418534A042099BCF10EFA8D885B9EFBA9BF45314F248156EC199B392D731DD11DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0099B370 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0099B47F,?,?,00000000,00000001,?,?,0099B6A9,00000022,FlsSetValue,00AAEB88,00AAEB90,00000001), ref: 0099B431

Strings

ext-ms-, xrefs: 0099B3DB
api-ms-, xrefs: 0099B3C7

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 652d27e1a360d47d6f8fb8cd5f007da12f02ddc7f24210717e5dac826ddef111
Instruction ID: ead04eca14a1b0525a8e603895f2c23ac8389168c35df8748ce41b4687d0fafd
Opcode Fuzzy Hash: 652d27e1a360d47d6f8fb8cd5f007da12f02ddc7f24210717e5dac826ddef111
Instruction Fuzzy Hash: 5A21EB31E42211BBDF21DBB9FD41A6A375CDB52760F240525F906A72E1DB38ED01D6D0

Uniqueness

Uniqueness Score: -1.00%

Function 00A152A0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 399COMMON

Download Yara Rule

Strings

4oST, xrefs: 00A155B5
4oST, xrefs: 00A1552A
149.18.24.96, xrefs: 00A15328
4oST, xrefs: 00A15451

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID:
String ID: 149.18.24.96$4oST$4oST$4oST
API String ID: 0-608211275
Opcode ID: 72457afa7c26ec47b159f54faeb8a7652c0817b4b7ff1c5aea5de678aa5beb6f
Instruction ID: 720757b163c08077dd704b51b34a15c862c2e17d16020640ceccb53f00cccb5d
Opcode Fuzzy Hash: 72457afa7c26ec47b159f54faeb8a7652c0817b4b7ff1c5aea5de678aa5beb6f
Instruction Fuzzy Hash: A1021170D05288DFDF14DFA8C9457DDBBB0AF94304F148199E8096B382DBB55E88DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0096A060 Relevance: 9.1, APIs: 6, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0096A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0096A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0096A0E7
__Getctype.LIBCPMT ref: 0096A1C5
std::_Facet_Register.LIBCPMT ref: 0096A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0096A223

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 58b932eb3aa53ed794171f0908dec8ba0235dcd6831248e1469d4e47561bfae8
Instruction ID: ec255b31a088cc944efae0a481e5b06c2e73cf1f96eaec5084bf75fc8e00499b
Opcode Fuzzy Hash: 58b932eb3aa53ed794171f0908dec8ba0235dcd6831248e1469d4e47561bfae8
Instruction Fuzzy Hash: 975198B0D01249CBDB10DFA8C9417AEBBF4BB11314F24825ED855AB391E774AE45CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00993623 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,9A0D8E66,?,?,00000000,00A9E6D5,000000FF,?,009935FF,?,?,009935D3,00000016), ref: 00993658
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0099366A
FreeLibrary.KERNEL32(00000000,?,00000000,00A9E6D5,000000FF,?,009935FF,?,?,009935D3,00000016), ref: 0099368C

Strings

CorExitProcess, xrefs: 00993662
mscoree.dll, xrefs: 00993651

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f7b56d9a9460e68ccc0bffb274496146eca86cc33292b2bf57917b14722f25c4
Instruction ID: 63777f7053c6ca99032cb910224cf27d002c96f9e13c0bb929aa5eee50ef590a
Opcode Fuzzy Hash: f7b56d9a9460e68ccc0bffb274496146eca86cc33292b2bf57917b14722f25c4
Instruction Fuzzy Hash: DF01A731A4461AFFDB11CF94DC09BAEBBF8FB05715F004629E812A26D0DB749A00CA50

Uniqueness

Uniqueness Score: -1.00%

Function 0096C430 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0096C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0096C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0096C4A4
std::_Facet_Register.LIBCPMT ref: 0096C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0096C5C4

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: b25ad073b055f57aaaa502f3b00227c72593fc4800d1f7a37a1bf6c903425fc6
Instruction ID: 4926196d4c249a3745c37a37b1f7a460dbd542791d8c3e55b7589adc1e747d8a
Opcode Fuzzy Hash: b25ad073b055f57aaaa502f3b00227c72593fc4800d1f7a37a1bf6c903425fc6
Instruction Fuzzy Hash: 2A51BCB0901248DFDB10DF98C854BAEBBF4FF40314F24815AE886AB391D775AA05CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00982BB8 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00982BCC
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00982BEB
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00982C19
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00982C74
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00982C8B

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: bd199f38f842b73857ae5e15347ca24e7b2a49526543f7e75c702356af0838f1
Instruction ID: 84d6204fb8892a98196829803a24e4a49a650728f36b8bf26ccc01d15dba5bf0
Opcode Fuzzy Hash: bd199f38f842b73857ae5e15347ca24e7b2a49526543f7e75c702356af0838f1
Instruction Fuzzy Hash: 2141383190070ADBCB20EF65C485ABEB3F8FF19350B6089AAE486D7750D734E985CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00954900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0095499F

Part of subcall function 009851EB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00981CF9,?,00AC69D8,74D723A0,?,74D723A0,-00AD6880), ref: 0098524B

Strings

ios_base::eofbit set, xrefs: 00954946
ios_base::failbit set, xrefs: 00954828, 00954941
ios_base::badbit set, xrefs: 00954937, 00954962

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-1866435925
Opcode ID: 924b43bfe3c24dc6badbbbf0b5cf839305607749a22d59de463ef359cc4f8616
Instruction ID: d6f4ad2900c837b70bc534a04d8cdb0ec65de3be94fdb49f043da71aabf76fe1
Opcode Fuzzy Hash: 924b43bfe3c24dc6badbbbf0b5cf839305607749a22d59de463ef359cc4f8616
Instruction Fuzzy Hash: B61129B29086447BCB14EF59CC03BA7739CE745B15F044A2DFD58872C2EB35A948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00998E8F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(9A0D8E66,00000000,00000000,?), ref: 00998EF2

Part of subcall function 0099EC43: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0099A854,?,00000000,-00000008), ref: 0099ECA4

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00999144
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0099918A
GetLastError.KERNEL32 ref: 0099922D

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 00cf357843401ef2f2d57df5cca85d8a3c27f5332b7a708be97d0aaaee37d836
Instruction ID: b2f356ddd96f2ef04fc17cce9528b4e226d7b511bd7c5b502e6dc0f210a6193c
Opcode Fuzzy Hash: 00cf357843401ef2f2d57df5cca85d8a3c27f5332b7a708be97d0aaaee37d836
Instruction Fuzzy Hash: 66D159B5D04249AFCF15CFECC884AADBBB9FF49310F14452EE46AEB251D630A942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00982719 Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00982720
std::_Lockit::_Lockit.LIBCPMT ref: 0098272B
std::_Lockit::~_Lockit.LIBCPMT ref: 00982799

Part of subcall function 0098287C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00982894

std::locale::_Setgloballocale.LIBCPMT ref: 00982746

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: f2291d3ecb07eb248fbf9aadf8a522ceeb54a17f64b8dd65543bbc47c74f85c3
Instruction ID: 73b688d71240df85976a9faa15028e6a04ea003940896eb7d7700e47d26265ac
Opcode Fuzzy Hash: f2291d3ecb07eb248fbf9aadf8a522ceeb54a17f64b8dd65543bbc47c74f85c3
Instruction Fuzzy Hash: 4501B835A006209BDB06FBB0C85167D7BA1BFC4B80B08400AE8021B3D2CF78AA02CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 009A6D22 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000,?,?,009A3DBC,?,00000001,?,?,?,00999281,?,00000000,00000000), ref: 009A6D39
GetLastError.KERNEL32(?,009A3DBC,?,00000001,?,?,?,00999281,?,00000000,00000000,?,?,?,0099985B,?), ref: 009A6D45

Part of subcall function 009A6D0B: CloseHandle.KERNEL32(FFFFFFFE,009A6D55,?,009A3DBC,?,00000001,?,?,?,00999281,?,00000000,00000000,?,?), ref: 009A6D1B

___initconout.LIBCMT ref: 009A6D55

Part of subcall function 009A6CCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009A6CFC,009A3DA9,?,?,00999281,?,00000000,00000000,?), ref: 009A6CE0

WriteConsoleW.KERNEL32(?,?,?,00000000,?,009A3DBC,?,00000001,?,?,?,00999281,?,00000000,00000000,?), ref: 009A6D6A

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 54bdf9336821a1ee3be4b4bd55afd733415c27f690ef8ff917c4066758cba124
Instruction ID: 9cd76d18850a98244533a8b622d50ee9c977900d523a9db5623e2fe4ede211b3
Opcode Fuzzy Hash: 54bdf9336821a1ee3be4b4bd55afd733415c27f690ef8ff917c4066758cba124
Instruction Fuzzy Hash: CDF01C36200115BBCF225FD1DC04A9A3F6AEB5A3A0F058011FA4D85160C7328C21DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00957350 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0095750C
___std_exception_destroy.LIBVCRUNTIME ref: 00957522

Strings

[json.exception., xrefs: 009573A1

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: be0896ae3997880121d14dc42522d5cc334325d9dba94a4873b5eebf290082af
Instruction ID: 40cba5a73ce9c3beae9baa5987eeb87b3ea6873a8eb0889b0dd4515a65411744
Opcode Fuzzy Hash: be0896ae3997880121d14dc42522d5cc334325d9dba94a4873b5eebf290082af
Instruction Fuzzy Hash: 5251D2B1D04248AFDB00DFA8C90579EFBB4EF51314F144269E850A73C2E7B59A48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009547F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0095499F

Part of subcall function 009851EB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00981CF9,?,00AC69D8,74D723A0,?,74D723A0,-00AD6880), ref: 0098524B

Strings

ios_base::failbit set, xrefs: 00954828
ios_base::badbit set, xrefs: 00954937, 00954962

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 1903096808-1240500531
Opcode ID: ba8eabeba5546a6fdb279516ceb800aafb5869788af23b3b94afcf7dce2e742c
Instruction ID: 6abc25365b1247b4f06ba4c03de77988bb822f24498e3dc42348d473cce0a299
Opcode Fuzzy Hash: ba8eabeba5546a6fdb279516ceb800aafb5869788af23b3b94afcf7dce2e742c
Instruction Fuzzy Hash: 9E4114B1D04248ABCB04DF59CC46BAEBBF8EB45710F14821DF954A7381D7759A44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00954040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00954061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 009540C4

Strings

bad locale name, xrefs: 009540E6

Memory Dump Source

Source File: 00000005.00000002.3566828903.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000005.00000002.3566774463.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3566828903.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567339352.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.3567534748.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_950000_MPGPH131.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 9bd739009a4ed28e1469816856044356854c2143caf7c8076078642ac51b258d
Instruction ID: 2c28fe2e4c81266ec7048f848bd458b224d7ea4f504d27445c2fb45fb7c35a15
Opcode Fuzzy Hash: 9bd739009a4ed28e1469816856044356854c2143caf7c8076078642ac51b258d
Instruction Fuzzy Hash: C1110370805B84EED721CF68C50474BBFF4AF15714F108A9DD08587B82D3B59A08C7A1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MPGPH131.exePID: 7588, Parent PID: 1044COMMON

Executed Functions

Function 00A14EB0 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(000003AC,0000FFFF,00001006,?,00000008), ref: 00A14F56
recv.WS2_32(?,00000004,00000002), ref: 00A14F71
WSAGetLastError.WS2_32 ref: 00A14F75
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 00A14FF3
recv.WS2_32(00000000,0000000C,00000008), ref: 00A15014
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 00A150B0
recv.WS2_32(00000000,?,00000008), ref: 00A150CB

Part of subcall function 00A15940: WSAStartup.WS2_32 ref: 00A1596A
Part of subcall function 00A15940: getaddrinfo.WS2_32(?,?,?,00AD6328), ref: 00A159EC
Part of subcall function 00A15940: socket.WS2_32(?,?,?), ref: 00A15A0D
Part of subcall function 00A15940: connect.WS2_32(00000000,00AA6B31,?), ref: 00A15A21
Part of subcall function 00A15940: closesocket.WS2_32(00000000), ref: 00A15A2D
Part of subcall function 00A15940: FreeAddrInfoW.WS2_32(?), ref: 00A15A3A
Part of subcall function 00A15940: WSACleanup.WS2_32 ref: 00A15A40

recv.WS2_32(?,00000004,00000008), ref: 00A151D3
__Xtime_get_ticks.LIBCPMT ref: 00A151DA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A151E8
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 00A15261
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 00A15269

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: cb1d670877d2d2634ab2d82de760fbd0ba15ac7b9efda9953855bd41ac813bdd
Instruction ID: 3bb2461b908193de92ff72af58803b1dcaf47e776540cfbb1b9ea2ff707b2389
Opcode Fuzzy Hash: cb1d670877d2d2634ab2d82de760fbd0ba15ac7b9efda9953855bd41ac813bdd
Instruction Fuzzy Hash: ACB18B71D00308DFEB15DFA8CC49BEDBBB5BB95300F24421AE455AB2D2D7B05985DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00A15940 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00A1596A
getaddrinfo.WS2_32(?,?,?,00AD6328), ref: 00A159EC
socket.WS2_32(?,?,?), ref: 00A15A0D
connect.WS2_32(00000000,00AA6B31,?), ref: 00A15A21
closesocket.WS2_32(00000000), ref: 00A15A2D
FreeAddrInfoW.WS2_32(?), ref: 00A15A3A
WSACleanup.WS2_32 ref: 00A15A40
FreeAddrInfoW.WS2_32(?), ref: 00A15A55

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: c1f23428d9ca26f6003fd3121d9a0615f8aaeb1dd6fe9b90b5bafc33ed966536
Instruction ID: 72e59fa13e58c42bc80903afa412f0c6118dd9d8ac895212614c70705214e255
Opcode Fuzzy Hash: c1f23428d9ca26f6003fd3121d9a0615f8aaeb1dd6fe9b90b5bafc33ed966536
Instruction Fuzzy Hash: EB31CE76904700ABD720DF74DC88A6ABBE5BF85374F144719F8A9961E0D3309845CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00959280 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,00A9A4DC,00000000,74D723A0,-00AD6880), ref: 009596A6
GetProcAddress.KERNEL32(00000000,?), ref: 009596B4
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00A9A4DC,00000000,74D723A0,-00AD6880), ref: 009596C9

Strings

4oST, xrefs: 00959660
Ws2_32.dll, xrefs: 0095969A
4oST, xrefs: 0095962C

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: 4oST$4oST$Ws2_32.dll
API String ID: 2819740048-1839276265
Opcode ID: 01acfe58d7ddc1c516b517dfaf33705e77e0733efc61bdd9c40a6e6e34e40756
Instruction ID: 106a5617bc7ecef934a33f18632718286e4fdccfd3721531f987265eff650645
Opcode Fuzzy Hash: 01acfe58d7ddc1c516b517dfaf33705e77e0733efc61bdd9c40a6e6e34e40756
Instruction Fuzzy Hash: 8502EF70D04298DFDF25CFA4C8907ADBBB0FF55314F244289E8856B686D774198ACF92

Uniqueness

Uniqueness Score: -1.00%

Function 00999779 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00998E8F: GetConsoleOutputCP.KERNEL32(9B16A19C,00000000,00000000,?), ref: 00998EF2

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009998FE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00999908

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 3c3ebaac4112aa3dc8c82613a53bfcb71e73b30bdc8a74f059ec8cadae7dfeb1
Instruction ID: 5172a3475b726c09966dcc9de5aa57059a5d15c523ce1b6aed31572088391e47
Opcode Fuzzy Hash: 3c3ebaac4112aa3dc8c82613a53bfcb71e73b30bdc8a74f059ec8cadae7dfeb1
Instruction Fuzzy Hash: 7A61B171C0411AAFDF11DFACC884AEEBBB9AF4A304F18054DE900A7256D736D941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00998DEF Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00998CD6,00000000,?,00AC7178,0000000C,00998D92,?,?,?), ref: 00998E45
GetLastError.KERNEL32(?,00998CD6,00000000,?,00AC7178,0000000C,00998D92,?,?,?), ref: 00998E4F

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: f57da5201e89efa948f1803125ec02dae3a2772832bdbe7b061fb8820b4f7bf8
Instruction ID: 3ca758f95e4a304da1a5a78a98ec607a8051bc523ba9d302bbfb6622e39c7705
Opcode Fuzzy Hash: f57da5201e89efa948f1803125ec02dae3a2772832bdbe7b061fb8820b4f7bf8
Instruction Fuzzy Hash: 27110832A142105ADE26BAFCAC59B7F278D8BC3734F29065DF919972D2DF219C818191

Uniqueness

Uniqueness Score: -1.00%

Function 0099250C Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,?,00992616,?,?,?,?,?), ref: 00992548
GetLastError.KERNEL32(?,?,?,?,00992616,?,?,?,?,?,00000000,?,00000000), ref: 00992555

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0abbb72c5aeefd9bbfdd6f6f42e87f21a16005abe0e8911c2e8a9a23e84dac45
Instruction ID: 0c70c042d466dcd76196c4adbcb829d3c92fefb935c53c8986530b0975581944
Opcode Fuzzy Hash: 0abbb72c5aeefd9bbfdd6f6f42e87f21a16005abe0e8911c2e8a9a23e84dac45
Instruction Fuzzy Hash: 3001C432610515BFCF09CF69DC159AE3B69EB85320B250208F8119B290E671ED52CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009532D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0095331F

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 88e0f75f83d5f9e69285ef2088a1dfdc1055322beeb667a90db4e8c6ac7f301f
Instruction ID: 6fdb47c5ac49e54f347aea3f6d129290e52db4a6ef10108fb6f58720a3134ab4
Opcode Fuzzy Hash: 88e0f75f83d5f9e69285ef2088a1dfdc1055322beeb667a90db4e8c6ac7f301f
Instruction Fuzzy Hash: D5F0BB711001049BCB14BF65D4159E9B3ECDF543D2750857AEC8DC7212FB36DA548790

Uniqueness

Uniqueness Score: -1.00%

Function 0099A64C Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001), ref: 0099A68D

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3c9d2c3607db7cb1f3efa9b85f924e21c95b0eb4cf1bff84d269e929258fbedd
Instruction ID: 8f4b3fd6da07a9a65d030053f0d63573deae6003328e135aa6a4c7cef8a310b9
Opcode Fuzzy Hash: 3c9d2c3607db7cb1f3efa9b85f924e21c95b0eb4cf1bff84d269e929258fbedd
Instruction Fuzzy Hash: 30F089336116256BEF225B6FDC05B5B374DEF92770B1D8112E809DA1A0DB34DC0186E6

Uniqueness

Uniqueness Score: -1.00%

Function 0099B086 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?), ref: 0099B0B8

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8b05ab11a9257f0ffc88b8b685391e940728f0bbeb7de58aff77dfc3d50e973f
Instruction ID: bd6261fb7de39da447976367b093bd3688e7820e7bfc2c9f6c2d0231a173a8bc
Opcode Fuzzy Hash: 8b05ab11a9257f0ffc88b8b685391e940728f0bbeb7de58aff77dfc3d50e973f
Instruction Fuzzy Hash: C7E06D316016216BEE312BAEFE04B5F364DAF823A0F150125FD29E70D5DB2DDC0082E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A1C630 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 240injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 00A1C6A1
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 00A1C6BD
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 00A1C6F2
VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 00A1C71B
WriteProcessMemory.KERNEL32(?,00000000,?,00000218,00000000), ref: 00A1C8BF
WriteProcessMemory.KERNEL32(?,00000218,00A1C990,-00000010,00000000), ref: 00A1C8E1
CreateRemoteThread.KERNEL32(?,00000000,00000000,00000218,00000000,00000000,00000000), ref: 00A1C8F4
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00A1C8FD

Strings

131, xrefs: 00A1C883, 00A1C893
4oST, xrefs: 00A1C7D2
%s|%s, xrefs: 00A1C89F

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: MemoryProcessWrite$AllocVirtual$CreateObjectRemoteSingleThreadWait
String ID: %s|%s$131$4oST
API String ID: 2137838514-1634972829
Opcode ID: 6b11d5fb82952678321389a7154d2c837a9af193c08aefa0415ab425549ecd96
Instruction ID: 9fc06e28fcefd7f3dab7efc937a8d73789dfc8d6010d4a3f176fb793bf33002c
Opcode Fuzzy Hash: 6b11d5fb82952678321389a7154d2c837a9af193c08aefa0415ab425549ecd96
Instruction Fuzzy Hash: DEB169B1D002089FDB14CFA4CC85BEEBBB1FF48310F104259E549AB291D775AA85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 009A32E1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,009A35F3,?,?), ref: 009A337A
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,009A35F3,?,?), ref: 009A33A3
GetACP.KERNEL32(?,?,009A35F3,?,?), ref: 009A33B8

Strings

OCP, xrefs: 009A3335
ACP, xrefs: 009A32FF

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8a72cdb63c62accd318503721ebe4564ed29f88a73129d630e20df655d3c72b4
Instruction ID: 7ed824a55a06018cdc24b6dfc1748fae4a84cb78f1d33b3e99038aec0305343e
Opcode Fuzzy Hash: 8a72cdb63c62accd318503721ebe4564ed29f88a73129d630e20df655d3c72b4
Instruction Fuzzy Hash: 8421A132608105AADF348F59D905B9B73AAAF52B50BD6C524F906DB150EF32DF41C3D0

Uniqueness

Uniqueness Score: -1.00%

Function 009A34BD Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00999E32: GetLastError.KERNEL32(00000000,?,0099F819), ref: 00999E36
Part of subcall function 00999E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00999ED8

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 009A35C5
IsValidCodePage.KERNEL32(?), ref: 009A3603
IsValidLocale.KERNEL32(?,00000001), ref: 009A3616
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 009A365E
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 009A3679

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 05942d18241a67f2866d612c7272348ae445fdaad66960f5cc8b78f3711c31e2
Instruction ID: 46131206798311c67b51aa247079fbc17fe4f88a0dd2e578e8e6868e170b812c
Opcode Fuzzy Hash: 05942d18241a67f2866d612c7272348ae445fdaad66960f5cc8b78f3711c31e2
Instruction Fuzzy Hash: 8F514F71E00206AFDB10DFA9DC45BBA77B8EF4A700F148469B915EB191EB70DA44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009A2B48 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00999E32: GetLastError.KERNEL32(00000000,?,0099F819), ref: 00999E36
Part of subcall function 00999E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00999ED8

GetACP.KERNEL32(?,?,?,?,?,?,009972F0,?,?,?,?,?,-00000050,?,?,?), ref: 009A2C07
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,009972F0,?,?,?,?,?,-00000050,?,?), ref: 009A2C3E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 009A2DA1

Strings

utf8, xrefs: 009A2D10

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 7102289a83dc41624b67b6dd821761cf539dec600520880eb3b5466469f6b5b7
Instruction ID: 7636616035ffa846e2d79823757621326088d1bc1fc548aa69116660d10f6999
Opcode Fuzzy Hash: 7102289a83dc41624b67b6dd821761cf539dec600520880eb3b5466469f6b5b7
Instruction Fuzzy Hash: 8F71E675600306AADB24AF7CCC46BBA73ACEF46710F14496AF945DB1C2EB74E94187E0

Uniqueness

Uniqueness Score: -1.00%

Function 0098C950 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d832fe2a0f42001a57c9b2c34ab75cd1b9a187cae735d2738bff895b2773b599
Instruction ID: 1fef4ad94d06fa0401d1450b479c981d5eb3380a4d3a0c3779392ed6a9507fc6
Opcode Fuzzy Hash: d832fe2a0f42001a57c9b2c34ab75cd1b9a187cae735d2738bff895b2773b599
Instruction Fuzzy Hash: 6C022CB1E012199BDF14DFA9D8806AEFBF5FF48314F248269E919E7381D731A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 009A79D3 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 009A79EC

Strings

asin, xrefs: 009A7B19
pow, xrefs: 009A7A8A, 009A7B34, 009A7B81
sqrt, xrefs: 009A7B2B
acos, xrefs: 009A7B22
log10, xrefs: 009A7A2E, 009A7A3D
exp, xrefs: 009A7A6B, 009A7AD0
log, xrefs: 009A7A49, 009A7A58

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: b94d92d4c896a4e4556b8ace7e140cac47d94f04e344e1c231aff12f86413431
Instruction ID: 4471d6d2dea7e4cb852bd723ee08abc4c214f1c785bd92a2cedba18b6bc26b4d
Opcode Fuzzy Hash: b94d92d4c896a4e4556b8ace7e140cac47d94f04e344e1c231aff12f86413431
Instruction Fuzzy Hash: F5518CB090860ADBDF108FE8EC491ADFFB8FB47310F554585D481AB2A4C7788A25CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0099BB58 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0099BBDE

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 88e4da6258101c5fc24b34185784eb547dfa0330ad300027970d950eece25734
Instruction ID: aae61f5169a5cfa6498d5ca0ed361b3028dc3b30afa7475634b63310d1c618e3
Opcode Fuzzy Hash: 88e4da6258101c5fc24b34185784eb547dfa0330ad300027970d950eece25734
Instruction Fuzzy Hash: 33B14672E00355AFEF218F6CDD81BEE7BA9EF55310F144155E944AF282E7789901C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 009872C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009872F7
___except_validate_context_record.LIBVCRUNTIME ref: 009872FF
_ValidateLocalCookies.LIBCMT ref: 00987388
__IsNonwritableInCurrentImage.LIBCMT ref: 009873B3
_ValidateLocalCookies.LIBCMT ref: 00987408

Strings

csm, xrefs: 0098739D

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 39cabb8ec6165f5d07af30a71d1aa6268b6f6d84af06596429af6e0903cc7cfc
Instruction ID: cc53102c2690cefdcc35962878267be9f61d80053e88fb81900062deb119c5ef
Opcode Fuzzy Hash: 39cabb8ec6165f5d07af30a71d1aa6268b6f6d84af06596429af6e0903cc7cfc
Instruction Fuzzy Hash: 3F418534A042099BCF10EFA8D885B9EFBA9BF45314F248156EC199B392D731DD11DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0099B370 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0099B47F,?,?,00000000,00000001,?,?,0099B6A9,00000022,FlsSetValue,00AAEB88,00AAEB90,00000001), ref: 0099B431

Strings

api-ms-, xrefs: 0099B3C7
ext-ms-, xrefs: 0099B3DB

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 652d27e1a360d47d6f8fb8cd5f007da12f02ddc7f24210717e5dac826ddef111
Instruction ID: ead04eca14a1b0525a8e603895f2c23ac8389168c35df8748ce41b4687d0fafd
Opcode Fuzzy Hash: 652d27e1a360d47d6f8fb8cd5f007da12f02ddc7f24210717e5dac826ddef111
Instruction Fuzzy Hash: 5A21EB31E42211BBDF21DBB9FD41A6A375CDB52760F240525F906A72E1DB38ED01D6D0

Uniqueness

Uniqueness Score: -1.00%

Function 00A152A0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 399COMMON

Download Yara Rule

Strings

4oST, xrefs: 00A15451
4oST, xrefs: 00A1552A
4oST, xrefs: 00A155B5
149.18.24.96, xrefs: 00A15328

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID:
String ID: 149.18.24.96$4oST$4oST$4oST
API String ID: 0-608211275
Opcode ID: 72457afa7c26ec47b159f54faeb8a7652c0817b4b7ff1c5aea5de678aa5beb6f
Instruction ID: 720757b163c08077dd704b51b34a15c862c2e17d16020640ceccb53f00cccb5d
Opcode Fuzzy Hash: 72457afa7c26ec47b159f54faeb8a7652c0817b4b7ff1c5aea5de678aa5beb6f
Instruction Fuzzy Hash: A1021170D05288DFDF14DFA8C9457DDBBB0AF94304F148199E8096B382DBB55E88DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0096A060 Relevance: 9.1, APIs: 6, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0096A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0096A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0096A0E7
__Getctype.LIBCPMT ref: 0096A1C5
std::_Facet_Register.LIBCPMT ref: 0096A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0096A223

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 58b932eb3aa53ed794171f0908dec8ba0235dcd6831248e1469d4e47561bfae8
Instruction ID: ec255b31a088cc944efae0a481e5b06c2e73cf1f96eaec5084bf75fc8e00499b
Opcode Fuzzy Hash: 58b932eb3aa53ed794171f0908dec8ba0235dcd6831248e1469d4e47561bfae8
Instruction Fuzzy Hash: 975198B0D01249CBDB10DFA8C9417AEBBF4BB11314F24825ED855AB391E774AE45CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00993623 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,9B16A19C,?,?,00000000,00A9E6D5,000000FF,?,009935FF,?,?,009935D3,00000016), ref: 00993658
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0099366A
FreeLibrary.KERNEL32(00000000,?,00000000,00A9E6D5,000000FF,?,009935FF,?,?,009935D3,00000016), ref: 0099368C

Strings

mscoree.dll, xrefs: 00993651
CorExitProcess, xrefs: 00993662

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f7b56d9a9460e68ccc0bffb274496146eca86cc33292b2bf57917b14722f25c4
Instruction ID: 63777f7053c6ca99032cb910224cf27d002c96f9e13c0bb929aa5eee50ef590a
Opcode Fuzzy Hash: f7b56d9a9460e68ccc0bffb274496146eca86cc33292b2bf57917b14722f25c4
Instruction Fuzzy Hash: DF01A731A4461AFFDB11CF94DC09BAEBBF8FB05715F004629E812A26D0DB749A00CA50

Uniqueness

Uniqueness Score: -1.00%

Function 0096C430 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0096C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0096C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0096C4A4
std::_Facet_Register.LIBCPMT ref: 0096C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0096C5C4

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: b25ad073b055f57aaaa502f3b00227c72593fc4800d1f7a37a1bf6c903425fc6
Instruction ID: 4926196d4c249a3745c37a37b1f7a460dbd542791d8c3e55b7589adc1e747d8a
Opcode Fuzzy Hash: b25ad073b055f57aaaa502f3b00227c72593fc4800d1f7a37a1bf6c903425fc6
Instruction Fuzzy Hash: 2A51BCB0901248DFDB10DF98C854BAEBBF4FF40314F24815AE886AB391D775AA05CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00982BB8 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00982BCC
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00982BEB
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00982C19
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00982C74
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00982C8B

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: bd199f38f842b73857ae5e15347ca24e7b2a49526543f7e75c702356af0838f1
Instruction ID: 84d6204fb8892a98196829803a24e4a49a650728f36b8bf26ccc01d15dba5bf0
Opcode Fuzzy Hash: bd199f38f842b73857ae5e15347ca24e7b2a49526543f7e75c702356af0838f1
Instruction Fuzzy Hash: 2141383190070ADBCB20EF65C485ABEB3F8FF19350B6089AAE486D7750D734E985CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00954900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0095499F

Part of subcall function 009851EB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00981CF9,?,00AC69D8,74D723A0,?,74D723A0,-00AD6880), ref: 0098524B

Strings

ios_base::failbit set, xrefs: 00954828, 00954941
ios_base::eofbit set, xrefs: 00954946
ios_base::badbit set, xrefs: 00954937, 00954962

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-1866435925
Opcode ID: 924b43bfe3c24dc6badbbbf0b5cf839305607749a22d59de463ef359cc4f8616
Instruction ID: d6f4ad2900c837b70bc534a04d8cdb0ec65de3be94fdb49f043da71aabf76fe1
Opcode Fuzzy Hash: 924b43bfe3c24dc6badbbbf0b5cf839305607749a22d59de463ef359cc4f8616
Instruction Fuzzy Hash: B61129B29086447BCB14EF59CC03BA7739CE745B15F044A2DFD58872C2EB35A948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00998E8F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(9B16A19C,00000000,00000000,?), ref: 00998EF2

Part of subcall function 0099EC43: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0099A854,?,00000000,-00000008), ref: 0099ECA4

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00999144
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0099918A
GetLastError.KERNEL32 ref: 0099922D

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 00cf357843401ef2f2d57df5cca85d8a3c27f5332b7a708be97d0aaaee37d836
Instruction ID: b2f356ddd96f2ef04fc17cce9528b4e226d7b511bd7c5b502e6dc0f210a6193c
Opcode Fuzzy Hash: 00cf357843401ef2f2d57df5cca85d8a3c27f5332b7a708be97d0aaaee37d836
Instruction Fuzzy Hash: 66D159B5D04249AFCF15CFECC884AADBBB9FF49310F14452EE46AEB251D630A942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00982719 Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00982720
std::_Lockit::_Lockit.LIBCPMT ref: 0098272B
std::_Lockit::~_Lockit.LIBCPMT ref: 00982799

Part of subcall function 0098287C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00982894

std::locale::_Setgloballocale.LIBCPMT ref: 00982746

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: f2291d3ecb07eb248fbf9aadf8a522ceeb54a17f64b8dd65543bbc47c74f85c3
Instruction ID: 73b688d71240df85976a9faa15028e6a04ea003940896eb7d7700e47d26265ac
Opcode Fuzzy Hash: f2291d3ecb07eb248fbf9aadf8a522ceeb54a17f64b8dd65543bbc47c74f85c3
Instruction Fuzzy Hash: 4501B835A006209BDB06FBB0C85167D7BA1BFC4B80B08400AE8021B3D2CF78AA02CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 009A6D22 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000,?,?,009A3DBC,?,00000001,?,?,?,00999281,?,00000000,00000000), ref: 009A6D39
GetLastError.KERNEL32(?,009A3DBC,?,00000001,?,?,?,00999281,?,00000000,00000000,?,?,?,0099985B,?), ref: 009A6D45

Part of subcall function 009A6D0B: CloseHandle.KERNEL32(FFFFFFFE,009A6D55,?,009A3DBC,?,00000001,?,?,?,00999281,?,00000000,00000000,?,?), ref: 009A6D1B

___initconout.LIBCMT ref: 009A6D55

Part of subcall function 009A6CCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009A6CFC,009A3DA9,?,?,00999281,?,00000000,00000000,?), ref: 009A6CE0

WriteConsoleW.KERNEL32(?,?,?,00000000,?,009A3DBC,?,00000001,?,?,?,00999281,?,00000000,00000000,?), ref: 009A6D6A

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 54bdf9336821a1ee3be4b4bd55afd733415c27f690ef8ff917c4066758cba124
Instruction ID: 9cd76d18850a98244533a8b622d50ee9c977900d523a9db5623e2fe4ede211b3
Opcode Fuzzy Hash: 54bdf9336821a1ee3be4b4bd55afd733415c27f690ef8ff917c4066758cba124
Instruction Fuzzy Hash: CDF01C36200115BBCF225FD1DC04A9A3F6AEB5A3A0F058011FA4D85160C7328C21DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00957350 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0095750C
___std_exception_destroy.LIBVCRUNTIME ref: 00957522

Strings

[json.exception., xrefs: 009573A1

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: be0896ae3997880121d14dc42522d5cc334325d9dba94a4873b5eebf290082af
Instruction ID: 40cba5a73ce9c3beae9baa5987eeb87b3ea6873a8eb0889b0dd4515a65411744
Opcode Fuzzy Hash: be0896ae3997880121d14dc42522d5cc334325d9dba94a4873b5eebf290082af
Instruction Fuzzy Hash: 5251D2B1D04248AFDB00DFA8C90579EFBB4EF51314F144269E850A73C2E7B59A48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009547F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0095499F

Part of subcall function 009851EB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00981CF9,?,00AC69D8,74D723A0,?,74D723A0,-00AD6880), ref: 0098524B

Strings

ios_base::failbit set, xrefs: 00954828
ios_base::badbit set, xrefs: 00954937, 00954962

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 1903096808-1240500531
Opcode ID: ba8eabeba5546a6fdb279516ceb800aafb5869788af23b3b94afcf7dce2e742c
Instruction ID: 6abc25365b1247b4f06ba4c03de77988bb822f24498e3dc42348d473cce0a299
Opcode Fuzzy Hash: ba8eabeba5546a6fdb279516ceb800aafb5869788af23b3b94afcf7dce2e742c
Instruction Fuzzy Hash: 9E4114B1D04248ABCB04DF59CC46BAEBBF8EB45710F14821DF954A7381D7759A44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00954040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00954061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 009540C4

Strings

bad locale name, xrefs: 009540E6

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 9bd739009a4ed28e1469816856044356854c2143caf7c8076078642ac51b258d
Instruction ID: 2c28fe2e4c81266ec7048f848bd458b224d7ea4f504d27445c2fb45fb7c35a15
Opcode Fuzzy Hash: 9bd739009a4ed28e1469816856044356854c2143caf7c8076078642ac51b258d
Instruction Fuzzy Hash: C1110370805B84EED721CF68C50474BBFF4AF15714F108A9DD08587B82D3B59A08C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00983D67 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00984540
___raise_securityfailure.LIBCMT ref: 00984628

Strings

c^do, xrefs: 00984619

Memory Dump Source

Source File: 00000006.00000002.3566754558.0000000000951000.00000040.00000001.01000000.00000004.sdmp, Offset: 00950000, based on PE: true

Associated: 00000006.00000002.3566708888.0000000000950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AD2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3566754558.0000000000AE2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AEC000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567247273.0000000000AF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000AF7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C27000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000C88000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000CD0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000000FE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.3567389500.0000000001282000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_950000_MPGPH131.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: c^do
API String ID: 3761405300-4013511018
Opcode ID: 1104bf62755a979140fc605753f3004caddeeb264ed685a012c4cf7d300e6974
Instruction ID: 7647ac9d9b0f56fb3f3acf1febd7292ad11f0a98d3fe4988071b4557c5d6bc5d
Opcode Fuzzy Hash: 1104bf62755a979140fc605753f3004caddeeb264ed685a012c4cf7d300e6974
Instruction Fuzzy Hash: F221F0B4902A00DFE705DFB5F985B847BA5FB18314F98846BE5068B3A0E3B09982CF40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RageMP131.exePID: 7652, Parent PID: 2580COMMON

Executed Functions

Function 006B4EB0 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(000003D0,0000FFFF,00001006,?,00000008), ref: 006B4F56
recv.WS2_32(?,00000004,00000002), ref: 006B4F71
WSAGetLastError.WS2_32 ref: 006B4F75
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 006B4FF3
recv.WS2_32(00000000,0000000C,00000008), ref: 006B5014
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 006B50B0
recv.WS2_32(00000000,?,00000008), ref: 006B50CB

Part of subcall function 006B5940: WSAStartup.WS2_32 ref: 006B596A
Part of subcall function 006B5940: getaddrinfo.WS2_32(?,?,?,00776328), ref: 006B59EC
Part of subcall function 006B5940: socket.WS2_32(?,?,?), ref: 006B5A0D
Part of subcall function 006B5940: connect.WS2_32(00000000,00746B31,?), ref: 006B5A21
Part of subcall function 006B5940: closesocket.WS2_32(00000000), ref: 006B5A2D
Part of subcall function 006B5940: FreeAddrInfoW.WS2_32(?), ref: 006B5A3A
Part of subcall function 006B5940: WSACleanup.WS2_32 ref: 006B5A40

recv.WS2_32(?,00000004,00000008), ref: 006B51D3
__Xtime_get_ticks.LIBCPMT ref: 006B51DA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006B51E8
Sleep.KERNEL32(00000001,00000000,?,00002710,00000000), ref: 006B5261
Sleep.KERNEL32(00000064,?,00002710,00000000), ref: 006B5269

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: 6220ae86e79995694378a173af82867ee137e2ee40f9b67d7ebfebeb42110d6d
Instruction ID: 8135a984e111219ec8a89e522dd61236224c9b22a3b7b401face24cd8bf9589b
Opcode Fuzzy Hash: 6220ae86e79995694378a173af82867ee137e2ee40f9b67d7ebfebeb42110d6d
Instruction Fuzzy Hash: 4EB1ADB1D00748DFEB14DFA8CC49BEDBBB2BB45300F108219E559AB2E2D7785984CB85

Uniqueness

Uniqueness Score: -1.00%

Function 006B5940 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 006B596A
getaddrinfo.WS2_32(?,?,?,00776328), ref: 006B59EC
socket.WS2_32(?,?,?), ref: 006B5A0D
connect.WS2_32(00000000,00746B31,?), ref: 006B5A21
closesocket.WS2_32(00000000), ref: 006B5A2D
FreeAddrInfoW.WS2_32(?), ref: 006B5A3A
WSACleanup.WS2_32 ref: 006B5A40
FreeAddrInfoW.WS2_32(?), ref: 006B5A55

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: bf37b7ae6937a92dabd583c436d9af43cd8fdb560198aa7652d72fb76631b54a
Instruction ID: 7d4330ec05d7b9a7d4140cf8e31b7b3293ea0df06de429b0665692f5f3d670e6
Opcode Fuzzy Hash: bf37b7ae6937a92dabd583c436d9af43cd8fdb560198aa7652d72fb76631b54a
Instruction Fuzzy Hash: 8831E675504700ABC7209F24DC84BEAB7E6FB85734F10471EF9A5A32E0E73498448796

Uniqueness

Uniqueness Score: -1.00%

Function 005F9280 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,0073A4DC,00000000,74D723A0,-00776880), ref: 005F96A6
GetProcAddress.KERNEL32(00000000,?), ref: 005F96B4
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,0073A4DC,00000000,74D723A0,-00776880), ref: 005F96C9

Strings

Ws2_32.dll, xrefs: 005F969A
4oST, xrefs: 005F9660
4oST, xrefs: 005F962C

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: 4oST$4oST$Ws2_32.dll
API String ID: 2819740048-1839276265
Opcode ID: b0195aef56d9ee5f2da1cfab4cdfe2c74a43f74a780004ee04cd8f30cac3f855
Instruction ID: 02d00c13653443fa7eb65124c3ca8d03bc589c0d77c95a5d6bea5f3220f2562e
Opcode Fuzzy Hash: b0195aef56d9ee5f2da1cfab4cdfe2c74a43f74a780004ee04cd8f30cac3f855
Instruction Fuzzy Hash: 9602DB70D04698DECF25CFA4C8907ADBFB1FF55310F24428DE4856B686D7781986CB92

Uniqueness

Uniqueness Score: -1.00%

Function 006B52A0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 399
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

149.18.24.96, xrefs: 006B5328
4oST, xrefs: 006B552A
4oST, xrefs: 006B55B5
4oST, xrefs: 006B5451

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID:
String ID: 149.18.24.96$4oST$4oST$4oST
API String ID: 0-608211275
Opcode ID: e631bf3b5fc127b8318b75413b41e2474e2e9ea847155107398e93dfbae36de9
Instruction ID: c3228f10b00d8e5fce81252eee809dcf4ed5544818224dc8060b6b3886f75cee
Opcode Fuzzy Hash: e631bf3b5fc127b8318b75413b41e2474e2e9ea847155107398e93dfbae36de9
Instruction Fuzzy Hash: 9B02F0B0D04258DEDF14DFA8C9457DDBBB2AF44304F1480ADD8096B386D7B95E88CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00639779 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00638E8F: GetConsoleOutputCP.KERNEL32(9B58D97E,00000000,00000000,?), ref: 00638EF2

WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 006398FE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00639908

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 9e9f77358247fc13f7937161943fa171cc4975b65d38cfa6d8be3e71394765dc
Instruction ID: ef5d420c567a57298bcc45389b467e9dd6415f30536361ae72b770fc9e5512d6
Opcode Fuzzy Hash: 9e9f77358247fc13f7937161943fa171cc4975b65d38cfa6d8be3e71394765dc
Instruction Fuzzy Hash: E761B3B1C04119AFDF11DFA8C844AEEBBBAAF4A304F180549E904A7256D7B1D941CFF4

Uniqueness

Uniqueness Score: -1.00%

Function 00638DEF Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNEL32(00000000,00000000,?,?,00638CD6,00000000,?,00767178,0000000C,00638D92,?,?,?), ref: 00638E45
GetLastError.KERNEL32(?,00638CD6,00000000,?,00767178,0000000C,00638D92,?,?,?), ref: 00638E4F

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 09dc1ae3932ed1ee0bb07f4f2d2c993b255cb319a1b157eb550c50c1d4cdebed
Instruction ID: 9ccadb0783bd5a56c5576cb18f49f6ef74248660be358febd18cfc03adb24d00
Opcode Fuzzy Hash: 09dc1ae3932ed1ee0bb07f4f2d2c993b255cb319a1b157eb550c50c1d4cdebed
Instruction Fuzzy Hash: E1116B33A003145ED6662374AC4ABFE274B8B86734F29060DF8189B2D2EF759C8182E4

Uniqueness

Uniqueness Score: -1.00%

Function 0063250C Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,00632616,?,?,?,?,?), ref: 00632548
GetLastError.KERNEL32(?,?,?,?,00632616,?,?,?,?,?,00000000,?,00000000), ref: 00632555

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 327032d78e49bf0246a5d5842ffa7b38e7faef37f488920657f0ff35ae68dc94
Instruction ID: 843100049cbb0f0f1623500857b1e1cc42b5f97f5dbf8610b94d17da2c587451
Opcode Fuzzy Hash: 327032d78e49bf0246a5d5842ffa7b38e7faef37f488920657f0ff35ae68dc94
Instruction Fuzzy Hash: 0F01D637610516AFCF058F59DC65D9E3B2AEB85330F244209F8119B2D0E671EE428BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0063B00C Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00641B36,?,00000000,?,?,00641DD7,?,00000007,?,?,006422CB,?,?), ref: 0063B022
GetLastError.KERNEL32(?,?,00641B36,?,00000000,?,?,00641DD7,?,00000007,?,?,006422CB,?,?), ref: 0063B02D

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: b434a4a541700d131c94d9e78c6b772acf3cd0a08565b19bf6bc0421c224272b
Instruction ID: 610ab6a2d3be2efa5b7edd102694a6adda81db4860e444fa645b4ac982150ec5
Opcode Fuzzy Hash: b434a4a541700d131c94d9e78c6b772acf3cd0a08565b19bf6bc0421c224272b
Instruction Fuzzy Hash: 75E08C32140214ABCB212BE4EC09B8A3A5ABB82395F048025F70C9A160DB388890CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 005F32D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 005F331F

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 88e0f75f83d5f9e69285ef2088a1dfdc1055322beeb667a90db4e8c6ac7f301f
Instruction ID: d65c558732a03453f5c21c962b91fd8df800beeca38389a7cef12be1100cff8a
Opcode Fuzzy Hash: 88e0f75f83d5f9e69285ef2088a1dfdc1055322beeb667a90db4e8c6ac7f301f
Instruction Fuzzy Hash: A1F024725001299BDB14AF64E8058F9B7E8FF143A1710097EEA8CC7252EB2EDA40CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0063A64C Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001), ref: 0063A68D

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d9f29a7bc78721c49698227865d28e05fb351de08d037f6581aaa971d94ee95a
Instruction ID: c0725afce0928a252de197ae7976124302aacac02504c1197261cdd9b207d395
Opcode Fuzzy Hash: d9f29a7bc78721c49698227865d28e05fb351de08d037f6581aaa971d94ee95a
Instruction Fuzzy Hash: 34F0E0321006216B9B215BD19D07B96374FAF43770F1D8115F8489B260DA34DC01A6E6

Uniqueness

Uniqueness Score: -1.00%

Function 0063B086 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?), ref: 0063B0B8

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f621240517e528ed8e789b0ce8f219e30ef555e9c347d0fde29211869e1afc44
Instruction ID: b7e38938db7fe81d78c792e07c03e59186b361c92612ac5c28964280d598ce29
Opcode Fuzzy Hash: f621240517e528ed8e789b0ce8f219e30ef555e9c347d0fde29211869e1afc44
Instruction Fuzzy Hash: 22E065316006106BE63927A59C01B9F364BAF423E0F151125FF269B2D1DB24CC4085F5

Uniqueness

Uniqueness Score: -1.00%

Function 008EEB8C Relevance: 1.3, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 008EEBB7

Memory Dump Source

Source File: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmp, Offset: 00797000, based on PE: true

Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 783d81fa5ce31c629ed09b258f97fcccd43a7e4753a3c4c8117fd625af855cc4
Instruction ID: 6ca0372cf06cfafbf4082c0b2b4acaf73241cc633caf5375d8f03ebe71c37036
Opcode Fuzzy Hash: 783d81fa5ce31c629ed09b258f97fcccd43a7e4753a3c4c8117fd625af855cc4
Instruction Fuzzy Hash: 5BE0E2B6714248ABDF60CE8DD884BAB339DFBC9720F108411FA0EE7208C234ED509761

Uniqueness

Uniqueness Score: -1.00%

Function 0088DE84 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000001.1831992730.0000000000797000.00000040.00000001.01000000.00000005.sdmp, Offset: 00797000, based on PE: true

Associated: 00000007.00000001.1831992730.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000001.1831992730.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000001.1831992730.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000001.1831992730.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_1_797000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e087e951b2fb2384612a75ca8321d8c067a6ae5d5f306d25c05badd41a5f75
Instruction ID: f2facd4122a05fbf950481ea39bae2d80c37bfb2502f9989be4f22d7470d1c3a
Opcode Fuzzy Hash: b1e087e951b2fb2384612a75ca8321d8c067a6ae5d5f306d25c05badd41a5f75
Instruction Fuzzy Hash: 2C113A30700205CBE755EF69E8C9A55B3A7FB8A314F148272E64A8B3A5CF74AC42CB55

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 006BC630 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 240injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 006BC6A1
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 006BC6BD
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 006BC6F2
VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 006BC71B
WriteProcessMemory.KERNEL32(?,00000000,?,00000218,00000000), ref: 006BC8BF
WriteProcessMemory.KERNEL32(?,00000218,006BC990,-00000010,00000000), ref: 006BC8E1
CreateRemoteThread.KERNEL32(?,00000000,00000000,00000218,00000000,00000000,00000000), ref: 006BC8F4
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 006BC8FD

Strings

%s|%s, xrefs: 006BC89F
4oST, xrefs: 006BC7D2
131, xrefs: 006BC883, 006BC893

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: MemoryProcessWrite$AllocVirtual$CreateObjectRemoteSingleThreadWait
String ID: %s|%s$131$4oST
API String ID: 2137838514-1634972829
Opcode ID: 0f893513633fbd5f2c7c8ddce94e08135fd984576b3eea12104286557b8582e6
Instruction ID: 32751ffe9df3130c81c33bdfdaf2186c8b8c43ab6e91b45cc951289de1cbc7c5
Opcode Fuzzy Hash: 0f893513633fbd5f2c7c8ddce94e08135fd984576b3eea12104286557b8582e6
Instruction Fuzzy Hash: 9AB159B1D00208DFDB14CFA4CC85BAEBBB5FF48310F108259E509AB291D775AA81CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 006432E1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,006435F3,?,?), ref: 0064337A
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,006435F3,?,?), ref: 006433A3
GetACP.KERNEL32(?,?,006435F3,?,?), ref: 006433B8

Strings

ACP, xrefs: 006432FF
OCP, xrefs: 00643335

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 84d405a53303db15cfa41759cf0a5a66b4e7385841ee9ba24c9dc76d0a3b95b2
Instruction ID: 0bd5cdfd6a8416102df54ca64b0bc40ddd6d28ae70f83afb77698e92a398e064
Opcode Fuzzy Hash: 84d405a53303db15cfa41759cf0a5a66b4e7385841ee9ba24c9dc76d0a3b95b2
Instruction Fuzzy Hash: 4B21A132A00164EBDB368F29D901ADB73A7AF50B50B568424E906DB305EF32DF41D350

Uniqueness

Uniqueness Score: -1.00%

Function 006434BD Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00639E32: GetLastError.KERNEL32(00000000,?,0063F819), ref: 00639E36
Part of subcall function 00639E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00639ED8

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 006435C5
IsValidCodePage.KERNEL32(?), ref: 00643603
IsValidLocale.KERNEL32(?,00000001), ref: 00643616
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 0064365E
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00643679

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: a2c6944002557f38b90f138e9e28c1aea80b9c98f4cddf8e90c6780954d2cad0
Instruction ID: f5a0332230e6005e5477646add9fea056501bdbe609ab18d0c419e80210c12c7
Opcode Fuzzy Hash: a2c6944002557f38b90f138e9e28c1aea80b9c98f4cddf8e90c6780954d2cad0
Instruction Fuzzy Hash: 945171B1A00226ABDB14EFA5DC45AFE77BABF44700F154429F910EB350DBB0DA40CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00642B48 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00639E32: GetLastError.KERNEL32(00000000,?,0063F819), ref: 00639E36
Part of subcall function 00639E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000007,000000FF), ref: 00639ED8

GetACP.KERNEL32(?,?,?,?,?,?,006372F0,?,?,?,?,?,-00000050,?,?,?), ref: 00642C07
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,006372F0,?,?,?,?,?,-00000050,?,?), ref: 00642C3E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00642DA1

Strings

utf8, xrefs: 00642D10

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: f62c81efd366ba081f764766af2354fbe247666c7bcc4d727514f71938a96ec0
Instruction ID: 90ba0f4d86d079ba9b0e5cd4569f200c1d98d340043343978f0a44d2a061db2a
Opcode Fuzzy Hash: f62c81efd366ba081f764766af2354fbe247666c7bcc4d727514f71938a96ec0
Instruction Fuzzy Hash: 1E712C75A00607AAD724AF74CC92BFA73AAFF05300F70442DF905D7281EB70E9418768

Uniqueness

Uniqueness Score: -1.00%

Function 0062C950 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d832fe2a0f42001a57c9b2c34ab75cd1b9a187cae735d2738bff895b2773b599
Instruction ID: 955f8b3ade5e0abd37530f1ca5cbe2ca4874cc54e6e1aa913ca112284f8b69fb
Opcode Fuzzy Hash: d832fe2a0f42001a57c9b2c34ab75cd1b9a187cae735d2738bff895b2773b599
Instruction Fuzzy Hash: 34022B71E016299FDB14CFA8D8806EEBBB2FF48324F248269D919A7341D731A941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 006479D3 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 006479EC

Strings

pow, xrefs: 00647A8A, 00647B34, 00647B81
log, xrefs: 00647A49, 00647A58
`-_, xrefs: 00647AB6, 00647B60, 00647BA6
acos, xrefs: 00647B22
log10, xrefs: 00647A2E, 00647A3D
sqrt, xrefs: 00647B2B
asin, xrefs: 00647B19
exp, xrefs: 00647A6B, 00647AD0

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: DecodePointer
String ID: `-_$acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-4246198880
Opcode ID: 9524a0d4d7c36b8516641b85498e6ec24813b5596a20d7a5420c4852a9bef7bc
Instruction ID: b58b8335964700cff4e41bd1d3674044a69139be451e306cdb98951a0428e62d
Opcode Fuzzy Hash: 9524a0d4d7c36b8516641b85498e6ec24813b5596a20d7a5420c4852a9bef7bc
Instruction Fuzzy Hash: 0051B07090860ACBDF149FA8E84C1ED7FB6FF05310F554195D481AB368CB788A66CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0060A060 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0060A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0060A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0060A0E7
__Getctype.LIBCPMT ref: 0060A1C5
std::_Facet_Register.LIBCPMT ref: 0060A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0060A223

Strings

E_, xrefs: 0060A1AE
PD_, xrefs: 0060A19A
PG_, xrefs: 0060A1BF

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: PD_$PG_$E_
API String ID: 1102183713-3557341036
Opcode ID: b3f49d1796451a62b417e0648bd2fb236d971b7239dcf4c5e1b4598b8e7a5068
Instruction ID: d948cb635250071164ae03fbf08cce1a0ec4b815762c7a7d944924586c7da2f9
Opcode Fuzzy Hash: b3f49d1796451a62b417e0648bd2fb236d971b7239dcf4c5e1b4598b8e7a5068
Instruction Fuzzy Hash: 9F51BAB0D40719DBDB14CF98C8417AEBBF0BB10354F18829CD855AB391D7B8AA84CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 006272C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006272F7
___except_validate_context_record.LIBVCRUNTIME ref: 006272FF
_ValidateLocalCookies.LIBCMT ref: 00627388
__IsNonwritableInCurrentImage.LIBCMT ref: 006273B3
_ValidateLocalCookies.LIBCMT ref: 00627408

Strings

csm, xrefs: 0062739D
`-_, xrefs: 006273CC
Wb, xrefs: 006273A5, 006273AE, 006273BF

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: `-_$csm$Wb
API String ID: 1170836740-4243561109
Opcode ID: 59b0e270605c954c640921091319d77304b3ca8c2a58410191738ed97767cb19
Instruction ID: 39436355c2dac9ec4772b9c4f1258ebb9f7284da239cd0c4f1b4de49278fbf7f
Opcode Fuzzy Hash: 59b0e270605c954c640921091319d77304b3ca8c2a58410191738ed97767cb19
Instruction Fuzzy Hash: 1741A334A046299FCF10DF68E884E9E7BE6EF45314F148159EC189B352DB35EA01CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0060C430 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0060C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0060C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0060C4A4
std::_Facet_Register.LIBCPMT ref: 0060C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0060C5C4

Strings

E_, xrefs: 0060C562
PD_, xrefs: 0060C54E

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: E_$PD_
API String ID: 459529453-2603283866
Opcode ID: ae69555cac17e404d9e2f098809ea1436ed36a4c7844f15a78083445c2697925
Instruction ID: c612e34b2807c43969cfbc1c0567e18b982076aaec313abe68d2d315fa4d7884
Opcode Fuzzy Hash: ae69555cac17e404d9e2f098809ea1436ed36a4c7844f15a78083445c2697925
Instruction Fuzzy Hash: B951FEB0940659DFDB15DF58C854BAEBBF1FB00324F24825CE809AB381D778AA45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0063BB58 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0063BBDE

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 88e4da6258101c5fc24b34185784eb547dfa0330ad300027970d950eece25734
Instruction ID: 1c09705f642ef4de748a963bf1819a291b1615b43ff3f881a14ffe6baf9483af
Opcode Fuzzy Hash: 88e4da6258101c5fc24b34185784eb547dfa0330ad300027970d950eece25734
Instruction Fuzzy Hash: 12B13772A003559FDB218F28CC82BEEBBA6EF55350F186159EA04AF382D774D901C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 0063B370 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0063B47F,?,?,00000000,00000001,?,?,0063B6A9,00000022,FlsSetValue,0074EB88,0074EB90,00000001), ref: 0063B431

Strings

ext-ms-, xrefs: 0063B3DB
api-ms-, xrefs: 0063B3C7

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 13c5c12fa7a882a8863b3b044344947850d9ad4b522b685e1f92bbc44f5c3e8b
Instruction ID: 86d868d173ab65db206ef86101675a9efab858a4f433e809705479ddd76990aa
Opcode Fuzzy Hash: 13c5c12fa7a882a8863b3b044344947850d9ad4b522b685e1f92bbc44f5c3e8b
Instruction Fuzzy Hash: DE218035E41220F7D7219B30DC41A9A779AEF423B0F245121FA05A7393DB74ED11CAD8

Uniqueness

Uniqueness Score: -1.00%

Function 00633623 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,9B58D97E,?,?,00000000,0073E6D5,000000FF,?,006335FF,?,?,006335D3,00000016), ref: 00633658
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0063366A
FreeLibrary.KERNEL32(00000000,?,00000000,0073E6D5,000000FF,?,006335FF,?,?,006335D3,00000016), ref: 0063368C

Strings

CorExitProcess, xrefs: 00633662
`-_, xrefs: 0063367B
mscoree.dll, xrefs: 00633651

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$`-_$mscoree.dll
API String ID: 4061214504-1292320349
Opcode ID: 00c6e0df236986d9e0b9495c16d584462d32c88e1c482fdfba56b74d65de64dc
Instruction ID: 8bd620a9e53813fe8812b2b7e612ae7cbd6761f33ec224739befdbc317bef763
Opcode Fuzzy Hash: 00c6e0df236986d9e0b9495c16d584462d32c88e1c482fdfba56b74d65de64dc
Instruction Fuzzy Hash: A6012B35544629FFDB118F40DC09BAEB7B8FB45B10F008126F812A23D0DB789E00CA84

Uniqueness

Uniqueness Score: -1.00%

Function 00622719 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00622720
std::_Lockit::_Lockit.LIBCPMT ref: 0062272B
std::_Lockit::~_Lockit.LIBCPMT ref: 00622799

Part of subcall function 0062287C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00622894

std::locale::_Setgloballocale.LIBCPMT ref: 00622746

Strings

`-_, xrefs: 00622768, 0062278C

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID: `-_
API String ID: 677527491-1818756280
Opcode ID: e0c24bb811a41d77363e8a870316ac2a688263e33d809f4a8a1e01bdfd4b8561
Instruction ID: b2ba5114862de1f49312088012590a2b824ab5d557e8c8a8943eca4bc355a856
Opcode Fuzzy Hash: e0c24bb811a41d77363e8a870316ac2a688263e33d809f4a8a1e01bdfd4b8561
Instruction Fuzzy Hash: 8901B175A00A32ABD705AB20E8555BD77B2FF85780B04800DE81117391DFB8AA46CF89

Uniqueness

Uniqueness Score: -1.00%

Function 00622BB8 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00622BCC
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00622BEB
RtlAcquireSRWLockExclusive.NTDLL(00000008), ref: 00622C19
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00622C74
RtlTryAcquireSRWLockExclusive.NTDLL(00000008), ref: 00622C8B

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 4a95683247c903c4c310f7c85d15acabdef44605ac508db089c83ef2e821cb0e
Instruction ID: c954ad0d3e504b8bc16ee11b20d149b398c15b55a094c6b574e0753a958a8270
Opcode Fuzzy Hash: 4a95683247c903c4c310f7c85d15acabdef44605ac508db089c83ef2e821cb0e
Instruction Fuzzy Hash: C5415B71A00E2BEBCB60CF64E4A09AEB3F6FF09350B10892AD456D7640D734E985DF65

Uniqueness

Uniqueness Score: -1.00%

Function 005F7350 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 005F750C
___std_exception_destroy.LIBVCRUNTIME ref: 005F7522

Strings

[json.exception., xrefs: 005F73A1
)_, xrefs: 005F7502, 005F751C

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )_$[json.exception.
API String ID: 4194217158-293714475
Opcode ID: 04324abd58d5a1fd6d5fc05e928b5bab13bc5418c3d7f860b66d00f6e12ade3d
Instruction ID: 5d06d9b281e9c9d3965cc662458c560a33977164c80ea4228e2ff3de17bbda80
Opcode Fuzzy Hash: 04324abd58d5a1fd6d5fc05e928b5bab13bc5418c3d7f860b66d00f6e12ade3d
Instruction Fuzzy Hash: 9251D0B0C047499FDB00DFA8C905BAEBBB4EF55314F14426DE850A72C2E7B95A44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005F4900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 005F499F

Part of subcall function 006251EB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00621CF9,?,007669D8,74D723A0,?,74D723A0,-00776880), ref: 0062524B

Strings

ios_base::eofbit set, xrefs: 005F4946
ios_base::badbit set, xrefs: 005F4937, 005F4962
ios_base::failbit set, xrefs: 005F4828, 005F4941

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-1866435925
Opcode ID: f7232d729b01da97f20aa986c24b9a2a1de065cf8765f03a364dde68151dd2da
Instruction ID: f5f07fc768e966a2ed306794683b5ce375959a8460641530d231d6c3d546e8fa
Opcode Fuzzy Hash: f7232d729b01da97f20aa986c24b9a2a1de065cf8765f03a364dde68151dd2da
Instruction Fuzzy Hash: 521136B2A44A486BC710DE58DC07BB73788E701710F044629FE5997282EBBCA905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00638E8F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(9B58D97E,00000000,00000000,?), ref: 00638EF2

Part of subcall function 0063EC43: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0063A854,?,00000000,-00000008), ref: 0063ECA4

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00639144
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0063918A
GetLastError.KERNEL32 ref: 0063922D

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 6682b95adc9de165edb1bcd65dc46d0e12626ff5b37fe474a4c43525586e91fa
Instruction ID: e714702d66adf2cb056cc4466f9a4bc2218bbdb889e330b23b4fdfb64f3dbd55
Opcode Fuzzy Hash: 6682b95adc9de165edb1bcd65dc46d0e12626ff5b37fe474a4c43525586e91fa
Instruction Fuzzy Hash: 72D19DB5D04649AFCB15CFA8C880AEDBBB6FF09310F24452AE419EB351D770A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00646D22 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000,?,?,00643DBC,?,00000001,?,?,?,00639281,?,00000000,00000000), ref: 00646D39
GetLastError.KERNEL32(?,00643DBC,?,00000001,?,?,?,00639281,?,00000000,00000000,?,?,?,0063985B,?), ref: 00646D45

Part of subcall function 00646D0B: CloseHandle.KERNEL32(FFFFFFFE,00646D55,?,00643DBC,?,00000001,?,?,?,00639281,?,00000000,00000000,?,?), ref: 00646D1B

___initconout.LIBCMT ref: 00646D55

Part of subcall function 00646CCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00646CFC,00643DA9,?,?,00639281,?,00000000,00000000,?), ref: 00646CE0

WriteConsoleW.KERNEL32(?,?,?,00000000,?,00643DBC,?,00000001,?,?,?,00639281,?,00000000,00000000,?), ref: 00646D6A

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1c6b12bbc480cf0ce92b9aa1f5aa2eaa3b45eb163208b86a79634593207e7318
Instruction ID: e51a5a5134eaea3df02604e369ebfa684775aa155153904dfc4460f0b7f2572c
Opcode Fuzzy Hash: 1c6b12bbc480cf0ce92b9aa1f5aa2eaa3b45eb163208b86a79634593207e7318
Instruction Fuzzy Hash: DCF0AC3A540158BBCF222F95DC04E993F67EF4A3A1F058415FA1D95231D7368C60DB96

Uniqueness

Uniqueness Score: -1.00%

Function 005F36E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005F3819
___std_exception_destroy.LIBVCRUNTIME ref: 005F38F0

Strings

)_, xrefs: 005F37ED, 005F38EA

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: )_
API String ID: 2970364248-2023640188
Opcode ID: 255bab0829a42dbe3714397cf72591009578cf4e298b80d0f076100ebe9cf71b
Instruction ID: ef7ed2e58f851c876618c224049b1c9f1de66e1041690d2e5d98d9e64981869a
Opcode Fuzzy Hash: 255bab0829a42dbe3714397cf72591009578cf4e298b80d0f076100ebe9cf71b
Instruction Fuzzy Hash: 056179B1C01658EFDB14CF98C944B9EFBB5FF08320F148259E854AB282D7B95A44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005F47F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 005F499F

Part of subcall function 006251EB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,74D723A0,?,00621CF9,?,007669D8,74D723A0,?,74D723A0,-00776880), ref: 0062524B

Strings

ios_base::badbit set, xrefs: 005F4937, 005F4962
ios_base::failbit set, xrefs: 005F4828

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 1903096808-1240500531
Opcode ID: d66324c8107f812fbb0236e857d64fd535c4d8a99c7d457d0a20e70ec50d2226
Instruction ID: 3b02ef5e7eab5f7ae4fe12bbf047aa027b78f8ab70d269c82969cbd37232724a
Opcode Fuzzy Hash: d66324c8107f812fbb0236e857d64fd535c4d8a99c7d457d0a20e70ec50d2226
Instruction Fuzzy Hash: 944126B1D00648AFDB04DF58CD45BAEBBB8FB45720F14821DF614A7382D7795A00CB95

Uniqueness

Uniqueness Score: -1.00%

Function 005F4040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005F4061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 005F40C4

Strings

bad locale name, xrefs: 005F40E6

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: f8a5fdd867d016b0f8ae5e52441ad8e2a4519ffc02f905ba73c17f1548d1adbb
Instruction ID: 0096350078a82120538e0e7cb0e28dd93944ea3e1974a009f33bf43bf062e8eb
Opcode Fuzzy Hash: f8a5fdd867d016b0f8ae5e52441ad8e2a4519ffc02f905ba73c17f1548d1adbb
Instruction Fuzzy Hash: 9111E6B0805BC4EED321CF68C50478BBFF4AF15714F148A8DE49597B82D3B9AA08CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00623D67 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00624540
___raise_securityfailure.LIBCMT ref: 00624628

Strings

xUw, xrefs: 00624623

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: xUw
API String ID: 3761405300-2886643060
Opcode ID: 31776242d17ac190e9259683032a33c9753ec80bdf55c48aa2a944d57bf8430f
Instruction ID: 7f549fc0b7781d90637f2987125327ad8f688ba6e817b9b6d17d8a19b175323a
Opcode Fuzzy Hash: 31776242d17ac190e9259683032a33c9753ec80bdf55c48aa2a944d57bf8430f
Instruction Fuzzy Hash: 0D21BFB4940B04DEE700DF25F885A543BA6FB18B94F90952AE50DCB3A0E7F869C1CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00606590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006065C9
___std_exception_copy.LIBVCRUNTIME ref: 006065FC

Strings

)_, xrefs: 006065BA, 006065ED

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: ___std_exception_copy
String ID: )_
API String ID: 2659868963-2023640188
Opcode ID: c540da2e78d60154719a77e3d81f32c7487f61cbaed52f425fb354b7de2d4929
Instruction ID: d17ac6ca3c51840644502c37b811167b5bb8231faf9230a43271bca89698becd
Opcode Fuzzy Hash: c540da2e78d60154719a77e3d81f32c7487f61cbaed52f425fb354b7de2d4929
Instruction Fuzzy Hash: 3C1170B1900708EBCB01CF98C980B86F7F8FF09720F10876AF91497641E774A550CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0062463B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00624646
___raise_securityfailure.LIBCMT ref: 00624703

Strings

xUw, xrefs: 006246FE

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: xUw
API String ID: 3761405300-2886643060
Opcode ID: 9abf0205bc7cb60e650506c0ee741f44ec76aa5881610dfdccc88bc1c6e60b18
Instruction ID: 1aff2811d3a0b43bf5574ede20a0b13e1a894d8e1bd8947b74868df7c86c7a3e
Opcode Fuzzy Hash: 9abf0205bc7cb60e650506c0ee741f44ec76aa5881610dfdccc88bc1c6e60b18
Instruction Fuzzy Hash: FF119FB8951A04DEE700DF25E9816443BB5FB18B94B91D52AE80CCB360E7F8A981DF49

Uniqueness

Uniqueness Score: -1.00%

Function 005F7A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 005F7A5C
___std_exception_destroy.LIBVCRUNTIME ref: 005F7A72

Strings

)_, xrefs: 005F7A52, 005F7A6C

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )_
API String ID: 4194217158-2023640188
Opcode ID: 3806671cb5866f21bda0b1e85669d8f9064d49a8ea333aed485e9ce4ac501cae
Instruction ID: 7a4e701405d7804aa498de25ed0d693ffbc61a3d5fb2e6977e59796228be5f62
Opcode Fuzzy Hash: 3806671cb5866f21bda0b1e85669d8f9064d49a8ea333aed485e9ce4ac501cae
Instruction Fuzzy Hash: B3F0C2B1800704EFC710CF98C90178DFBF8EB05720F00066DE414A3780D7B956148B96

Uniqueness

Uniqueness Score: -1.00%

Function 0062360D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00623067,?,?,?,?,006B51DF), ref: 00623645
GetSystemTimeAsFileTime.KERNEL32(?,9B58D97E,00000000,?,0073E6F2,000000FF,?,00623067,?,?,?,?,006B51DF), ref: 00623649

Strings

`-_, xrefs: 0062363F

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID: `-_
API String ID: 743729956-1818756280
Opcode ID: e88e0803a946476d7b366d982e4fb0a1f6a6f447946cbd7c33c8af2d2a1b90ef
Instruction ID: f09b3b72833d0920adfce82eb3fe0f327ad4b037c7ba886a3f3be9c3670b18ec
Opcode Fuzzy Hash: e88e0803a946476d7b366d982e4fb0a1f6a6f447946cbd7c33c8af2d2a1b90ef
Instruction Fuzzy Hash: 7FF03076944A64FFC7118F54EC01B59B7A9F709F60F008126E91297790DB79A900CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0063B7E6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000016,00000001,006289C2,00000001,00000016,00628BD1,?,?,?,?,?,00000000), ref: 0063B826

Strings

`-_, xrefs: 0063B816
InitializeCriticalSectionEx, xrefs: 0063B7F6

Memory Dump Source

Source File: 00000007.00000002.3566548311.00000000005F1000.00000040.00000001.01000000.00000005.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000007.00000002.3566405724.00000000005F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3566548311.0000000000782000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.000000000078C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000791000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567043357.0000000000794000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000797000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.00000000008E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000928000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.3567207263.0000000000F22000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5f0000_RageMP131.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$`-_
API String ID: 2593887523-1341092918
Opcode ID: e13de063d9871fd220711b874c9c33c9d82ef8f3fe29bc76c47dd74779901639
Instruction ID: 380944a7dd9efea76af54266472f189595b54284a275f67ce15e6871e00bd060
Opcode Fuzzy Hash: e13de063d9871fd220711b874c9c33c9d82ef8f3fe29bc76c47dd74779901639
Instruction Fuzzy Hash: E3E09235681218B7CB112F50DC05EAE7F17FB44B70F00C021FA2959161C7B64821ABC9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\QEGVANwj0k6bYEp2nEbzchm.zip

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\02zdBXl47cvzcookies.sqlite

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\21DwcKzffyvaHistory

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\3b6N2Xdh3CYwplaces.sqlite

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\6IHWoe8lbZ9DHistory

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\7_kVUmGHRa2QCookies

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\B3Goucp0LR0WHistory

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\D4_tggVjtkMeHistory

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\D87fZN3R3jFeplaces.sqlite

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\G_ExU1umMCApWeb Data

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\H6IiOe1a4hMNWeb Data

C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\KBaxgQuPqXyZWeb Data

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

Function 00E95940 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre