Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
Analysis ID:	1435791
MD5:	8d6e0fa54df379d380222a4051ab848c
SHA1:	aaf9a4b13c41beb62d8b40440a37e999c512a33a
SHA256:	bc85f6c9d136388898852a62309eef10a34b3118fd024281e14e468594c2ff9f
Tags:	exeRiseProStealer
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Hides threads from debuggers

PE file has nameless sections

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe (PID: 796 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe" MD5: 8D6E0FA54DF379D380222A4051AB848C)

schtasks.exe (PID: 7148 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6688 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 1544 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 1980 MD5: C31336C1EFC2CCB44B4326EA793040F2)

chrome.exe (PID: 5600 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:/// MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2032,i,13373424599956482758,2622410995844212760,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 --field-trial-handle=2032,i,13373424599956482758,2622410995844212760,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6816 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

MPGPH131.exe (PID: 6788 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 8D6E0FA54DF379D380222A4051AB848C)

WerFault.exe (PID: 7116 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 1896 MD5: C31336C1EFC2CCB44B4326EA793040F2)

chrome.exe (PID: 7576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1904,i,4433995280801359943,15790253874222841577,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

MPGPH131.exe (PID: 7212 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 8D6E0FA54DF379D380222A4051AB848C)

WerFault.exe (PID: 7204 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7212 -s 1260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

RageMP131.exe (PID: 8700 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 8D6E0FA54DF379D380222A4051AB848C)

WerFault.exe (PID: 8040 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8700 -s 2004 MD5: C31336C1EFC2CCB44B4326EA793040F2)

RageMP131.exe (PID: 9080 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 8D6E0FA54DF379D380222A4051AB848C)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\_GC5VU0C8TlDHIYOayOodaC.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\6vITM1PSugWZudEYSR57YQU.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\gWpl3DKIKrL9jhWS6lgcZ2J.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1901048371.0000000001983000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1901198665.0000000001994000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.2092162134.0000000001A27000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2092743314.0000000001B18000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1901048371.0000000001993000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2104666258.000000000186E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2086799247.000000000183E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000003.1997073810.0000000001890000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000003.1996378466.0000000001890000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000003.1996163003.0000000001890000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000003.2027506796.0000000001892000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000003.2025987376.0000000001B61000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000002.2104822243.0000000001894000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2087269629.0000000001983000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000002.2104214514.000000000173D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000003.2026230623.0000000001B6B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000003.2026205617.0000000001B62000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.2092977467.0000000001B6C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000D.00000002.2099657926.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000003.2027559370.000000000186E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000003.2025987376.0000000001B16000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe PID: 796	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe PID: 796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 6788	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 6788	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7212	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7212	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 8700	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 8700	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 9080	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 30 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, ProcessId: 796, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/03/24-07:23:28.105870
SID:	2046269
Source Port:	49763
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/03/24-07:22:59.725168
SID:	2046267
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/03/24-07:22:56.225615
SID:	2046266
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/03/24-07:22:59.405493
SID:	2046269
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/03/24-07:23:15.979133
SID:	2046269
Source Port:	49745
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/03/24-07:23:24.180700
SID:	2046266
Source Port:	58709
Destination Port:	49763
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/03/24-07:23:42.768589
SID:	2046267
Source Port:	58709
Destination Port:	49763
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/03/24-07:23:27.210544
SID:	2046269
Source Port:	49760
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/03/24-07:23:16.615218
SID:	2046266
Source Port:	58709
Destination Port:	49760
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/03/24-07:23:19.547675
SID:	2046267
Source Port:	58709
Destination Port:	49760
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/03/24-07:22:56.058203
SID:	2049060
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/03/24-07:23:16.143178
SID:	2046269
Source Port:	49744
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/03/24-07:23:05.888918
SID:	2046266
Source Port:	58709
Destination Port:	49745
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/03/24-07:23:05.759701
SID:	2046266
Source Port:	58709
Destination Port:	49744
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/03/24-07:23:08.989573
SID:	2046267
Source Port:	58709
Destination Port:	49744
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/03/24-07:23:09.005119
SID:	2046267
Source Port:	58709
Destination Port:	49745
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://147.45.47.102:57893/hera/amadka.exe

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Avira: detection malicious, Label: HEUR/AGEN.1306558
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Avira: detection malicious, Label: HEUR/AGEN.1306558

Multi AV Scanner detection for domain / URL

Source: http://147.45.47.102:57893/hera/amadka.exeot	Virustotal: Detection: 15%	Perma Link
Source: http://147.45.47.102:57893/hera/amadka.exe68.0	Virustotal: Detection: 15%	Perma Link
Source: http://193.233.132.56/cost/go.exe	Virustotal: Detection: 25%	Perma Link
Source: http://147.45.47.102:57893/hera/amadka.exe	Virustotal: Detection: 18%	Perma Link
Source: http://193.233.132.56/cost/lenin.exe	Virustotal: Detection: 26%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 50%
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Virustotal: Detection: 58%	Perma Link
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Virustotal: Detection: 58%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	ReversingLabs: Detection: 50%
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Virustotal: Detection: 58%			Perma Link

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00643EB0 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		0_2_00643EB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00823EB0 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		7_2_00823EB0

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.24.82:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.24.82:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49781 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_0065D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_0065D2B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_006433B0 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_006433B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00611A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	0_2_00611A60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00663B20 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_00663B20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005B1F8C FindClose,FindFirstFileExW,GetLastError,	0_2_005B1F8C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005B2012 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_005B2012
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_006113F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_006113F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0083D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	7_2_0083D2B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_008233B0 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	7_2_008233B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007F1A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	7_2_007F1A60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00843B20 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	7_2_00843B20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00791F8C FindClose,FindFirstFileExW,GetLastError,	7_2_00791F8C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00792012 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	7_2_00792012
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007F13F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	7_2_007F13F0

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_703cab63ddfc30e52e5285a77dd3d65328718bd_cadc5c4f_ca1ea967-fef8-45d7-a94d-43811e9047c7\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_f7fc5d77e4181bfc8c190387d813954cf99dd80_2d68038f_ba0e7d69-f458-483a-978e-dbc15423d24c\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49730 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49730 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49744
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49745
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49744
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49745
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49745 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49744 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49760
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49760
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49763
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49760 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49763 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49763

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 147.45.47.93:58709

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 104.26.5.15 104.26.5.15
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Code function: 0_2_006452A0 recv,GetCurrentProcess,

0_2_006452A0

Source: global traffic	HTTP traffic detected: GET /widget/demo/191.96.227.219 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=191.96.227.219 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YOPbGLbp0bEGIjA9RjS4dnTf9TMc_WNOZoEqYCGZPMusvyHbkcGkBp0b60YgEyf8aWQGPDnoAkT6yZQyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-03-05; NID=513=APNOzOblleRB1aJFPx8Z_gRLPnRmzF3um8G7RczJpJHmMs2PjggLJuQJDSfSkkQEQw4W68eqU9PX_RTcXywZXXUq_AQqC0hF8Ap_QEpQOLc-nzbFkFzjdPZ3R_RYwXhxUJye9FK_ULZoYVxD6FGWtw5mxdI8GicRmXl8qJSIPUA
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YOPbGLfp0bEGIjBOCVhRAJULzteCOxPiY_X6uQIji4BS0T9mLaHtP_Am7ecKTeSvtZKtamBURy9fib0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-03-05; NID=513=cj89ODLx9-NktihWgR6pcEkVLJtmzBmUJFxO5DHSM_Ex4E-3z8ovz6JNixtHvLzVH43EiHaIwe1tovaDxh4FgY0d0QihWT12B-WBStzI-FDmf6tkDRL3VTxmW2AgAZsr1Tppx2YUWmkCPuT4nscUI9perMpwKY6l9iEl-alk_30
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/ddljson%3Fasync%3Dntp:2&q=EgS_YOPbGLbp0bEGIjDNZc3MZHlf1E0orMqnosUmz6W763DCXYHXDGytrbaZJcGJLjun_vRC8GiTovYLXb8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-03-05; NID=513=EQD99ALJd6fOZu26GG9BtUjXBRf2gGBsuk5QaS83mUVQaqMpvZ4LNdhssAidlPr7GtfSBFeiMvNnnYNjxcnDCKLiRS44NSdXzIk9nQXC3r6txe-PaW2vKLuatBzEjiBpwv1s228V4FQEbPNYX_vzR8IICWLCpTWJe0qikJMZQ84
Source: global traffic	HTTP traffic detected: GET /widget/demo/191.96.227.219 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/191.96.227.219 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=191.96.227.219 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=191.96.227.219 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=obBedr2UOoU2yNe&MD=DdSnfapD HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/191.96.227.219 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=191.96.227.219 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/191.96.227.219 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=191.96.227.219 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=obBedr2UOoU2yNe&MD=DdSnfapD HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe68.0
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe68.0x
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exejaxxwa
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeot
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exetspX(
Source: MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exe
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.execeIdser
Source: MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exeisepro_bot
Source: MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exe
Source: MPGPH131.exe, 00000007.00000002.2104214514.0000000001730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exeUs
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exeXb5?7
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exeka.ex;
Source: MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exeka.exbota
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exer
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: Amcache.hve.20.dr	String found in binary or memory: http://upx.sf.net
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2102864029.0000000000761000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2090843133.0000000000761000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098106504.0000000000721000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2192978530.0000000000721000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/A
Source: RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/c
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.000000000156A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.227.219
Source: MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.227.219.outloo
Source: MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.227.2191s
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.227.219D
Source: MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.227.219IuG
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.227.219QW
Source: RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.227.219n?x
Source: RageMP131.exe, 0000000F.00000002.2194242592.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.227.219ot
Source: MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.227.219yUk
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=191.96.227.219
Source: MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=191.96.227.219P
Source: MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=191.96.227.219lu
Source: RageMP131.exe, 0000000F.00000002.2194242592.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=191.96.227.219r)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RageMP131.exe, 0000000F.00000002.2194242592.000000000155F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RageMP131.exe, 0000000F.00000002.2194242592.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/#:
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018C3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2104214514.00000000017C0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2092162134.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2102864029.0000000000761000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2090843133.0000000000761000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098106504.0000000000721000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2192978530.0000000000721000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.0000000001878000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2104214514.0000000001779000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2104214514.00000000017C0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2092162134.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2092162134.0000000001A60000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001A69000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001532000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/191.96.227.219
Source: MPGPH131.exe, 00000008.00000002.2092162134.0000000001A60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/191.96.227.2190
Source: MPGPH131.exe, 00000007.00000002.2104214514.0000000001779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/191.96.227.219E
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/191.96.227.219S2
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001A69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/191.96.227.219hE
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018C3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2104214514.00000000017C0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2092162134.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/191.96.227.219
Source: D87fZN3R3jFeplaces.sqlite.13.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.13.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.13.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1863787047.00000000072D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1857497356.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1960562962.0000000001896000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1954095590.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1955332457.0000000001B86000.00000004.00000020.00020000.00000000.sdmp, ofPO1RwvHkuAHistory.0.dr, FAL14YoTdbqiHistory.13.dr, zJuLTaGAiOucHistory.13.dr, i1yIsS8bZnbMHistory.8.dr, 9cOnGTGkShnWHistory.0.dr, 2HnRxWloJpRxHistory.7.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: ofPO1RwvHkuAHistory.0.dr, FAL14YoTdbqiHistory.13.dr, zJuLTaGAiOucHistory.13.dr, i1yIsS8bZnbMHistory.8.dr, 9cOnGTGkShnWHistory.0.dr, 2HnRxWloJpRxHistory.7.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1863787047.00000000072D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1857497356.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1960562962.0000000001896000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1954095590.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1955332457.0000000001B86000.00000004.00000020.00020000.00000000.sdmp, ofPO1RwvHkuAHistory.0.dr, FAL14YoTdbqiHistory.13.dr, zJuLTaGAiOucHistory.13.dr, i1yIsS8bZnbMHistory.8.dr, 9cOnGTGkShnWHistory.0.dr, 2HnRxWloJpRxHistory.7.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: ofPO1RwvHkuAHistory.0.dr, FAL14YoTdbqiHistory.13.dr, zJuLTaGAiOucHistory.13.dr, i1yIsS8bZnbMHistory.8.dr, 9cOnGTGkShnWHistory.0.dr, 2HnRxWloJpRxHistory.7.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, _GC5VU0C8TlDHIYOayOodaC.zip.8.dr, 6vITM1PSugWZudEYSR57YQU.zip.13.dr, gWpl3DKIKrL9jhWS6lgcZ2J.zip.0.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: MPGPH131.exe, 00000008.00000002.2092743314.0000000001B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2025987376.0000000001B16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT4
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1901198665.0000000001994000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1901048371.0000000001993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT=
Source: MPGPH131.exe, 00000007.00000002.2104666258.000000000186E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTV
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTh
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTl
Source: RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro
Source: RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.8.dr, passwords.txt.0.dr, passwords.txt.13.dr	String found in binary or memory: https://t.me/risepro_bot
Source: MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot)
Source: MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot7.219
Source: RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot7.219H
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botAb
Source: MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botL#2
Source: MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botb#D
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_boteb
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.13.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.13.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: D87fZN3R3jFeplaces.sqlite.13.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/;b
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1901048371.0000000001983000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1860303528.0000000001983000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1857711497.0000000001983000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859526244.0000000001983000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859773130.0000000001983000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1856547579.0000000001983000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1955347396.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1957436453.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1941467920.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1958813737.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1976563824.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1992001998.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1960474585.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1962204832.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961923009.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1989731832.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1954133777.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1950407144.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2104666258.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961204708.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1947493623.000000000186E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/k#O
Source: D87fZN3R3jFeplaces.sqlite.13.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/eata
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1901048371.0000000001983000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1860303528.0000000001983000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1857711497.0000000001983000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859526244.0000000001983000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859773130.0000000001983000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1856547579.0000000001983000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1955347396.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1957436453.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1941467920.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1958813737.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1976563824.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1992001998.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1960474585.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1962204832.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961923009.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1989731832.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1954133777.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1950407144.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2104666258.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961204708.000000000186E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1947493623.000000000186E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MPGPH131.exe, 00000007.00000002.2104214514.0000000001730000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/r
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox
Source: MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refoxt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.24.82:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.24.82:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49781 version: TLS 1.2

System Summary

PE file has nameless sections

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005C001D	0_2_005C001D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00678080	0_2_00678080
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_006161D0	0_2_006161D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_0065D2B0	0_2_0065D2B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_0065C3E0	0_2_0065C3E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005FF730	0_2_005FF730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_0065B7E0	0_2_0065B7E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_0058B8E0	0_2_0058B8E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_006BC8D0	0_2_006BC8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_006549B0	0_2_006549B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00611A60	0_2_00611A60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00618A80	0_2_00618A80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_0061CBF0	0_2_0061CBF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00627D20	0_2_00627D20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_0061AEC0	0_2_0061AEC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00613ED0	0_2_00613ED0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_0060DF60	0_2_0060DF60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_006B20C0	0_2_006B20C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_006C40A0	0_2_006C40A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_006C3160	0_2_006C3160
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00621130	0_2_00621130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00602100	0_2_00602100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005B7190	0_2_005B7190
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005C035F	0_2_005C035F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00670350	0_2_00670350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005AF570	0_2_005AF570
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005D47AD	0_2_005D47AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005BC950	0_2_005BC950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005BA918	0_2_005BA918
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005CDA74	0_2_005CDA74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_006C4AE0	0_2_006C4AE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00610BA0	0_2_00610BA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00664B90	0_2_00664B90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005D8BA0	0_2_005D8BA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00621E40	0_2_00621E40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005D8E20	0_2_005D8E20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_0066BFC0	0_2_0066BFC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_0066CFC0	0_2_0066CFC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA70000	0_2_7FA70000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA70819	0_2_7FA70819
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00858080	7_2_00858080
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007A001D	7_2_007A001D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007F61D0	7_2_007F61D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_008A3160	7_2_008A3160
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0083D2B0	7_2_0083D2B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0083C3E0	7_2_0083C3E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007DF730	7_2_007DF730
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0083B7E0	7_2_0083B7E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0089C8D0	7_2_0089C8D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0076B8E0	7_2_0076B8E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_008349B0	7_2_008349B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007F1A60	7_2_007F1A60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007F8A80	7_2_007F8A80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007FCBF0	7_2_007FCBF0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00807D20	7_2_00807D20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007B8E20	7_2_007B8E20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007F3ED0	7_2_007F3ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007FAEC0	7_2_007FAEC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007EDF60	7_2_007EDF60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_008A40A0	7_2_008A40A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_008920C0	7_2_008920C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007E2100	7_2_007E2100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00801130	7_2_00801130
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00797190	7_2_00797190
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007A035F	7_2_007A035F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00850350	7_2_00850350
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0078F570	7_2_0078F570
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007B47AD	7_2_007B47AD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0079C950	7_2_0079C950
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0079A918	7_2_0079A918
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007ADA74	7_2_007ADA74
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_008A4AE0	7_2_008A4AE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00844B90	7_2_00844B90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007B8BA0	7_2_007B8BA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007F0BA0	7_2_007F0BA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00801E40	7_2_00801E40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0084BFC0	7_2_0084BFC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0084CFC0	7_2_0084CFC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_7F6F0000	7_2_7F6F0000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_7F6F0819	7_2_7F6F0819

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: String function: 0059ACE0 appears 86 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0077ACE0 appears 86 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 1980

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000000.1628134455.0000000000724000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: Section: ZLIB complexity 0.9997618952472294
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: Section: ZLIB complexity 0.9934290213178295
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: Section: ZLIB complexity 0.99462890625
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: Section: ZLIB complexity 1.0006510416666667
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997618952472294
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9934290213178295
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99462890625
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0006510416666667
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997618952472294
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9934290213178295
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99462890625
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0006510416666667

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@44/85@9/7

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Code function: 0_2_0065D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

0_2_0065D2B0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7212
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6668:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess796
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8700
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6788

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2102864029.0000000000761000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2090843133.0000000000761000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098106504.0000000000721000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2192978530.0000000000721000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2102864029.0000000000761000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2090843133.0000000000761000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098106504.0000000000721000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2192978530.0000000000721000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1856547579.0000000001945000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1953686131.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951033571.0000000001B62000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1954095590.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B96000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1949927709.0000000001B62000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1955332457.0000000001BA2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1953855338.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1954990178.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp, TgQ4S6c4BAPSLogin Data.7.dr, FbUnNuCw4_bKLogin Data.13.dr, KschALC58KiLLogin Data For Account.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	ReversingLabs: Detection: 50%
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Virustotal: Detection: 58%

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2032,i,13373424599956482758,2622410995844212760,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1904,i,4433995280801359943,15790253874222841577,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 --field-trial-handle=2032,i,13373424599956482758,2622410995844212760,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 1980
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8700 -s 2004
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7212 -s 1260
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 1896
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2032,i,13373424599956482758,2622410995844212760,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 --field-trial-handle=2032,i,13373424599956482758,2622410995844212760,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1904,i,4433995280801359943,15790253874222841577,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: version.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: shfolder.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: profapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Static file information: File size 3197440 > 1048576

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x225a00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Unpacked PE file: 0.2.SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe.580000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 7.2.MPGPH131.exe.760000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 8.2.MPGPH131.exe.760000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 13.2.RageMP131.exe.720000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 15.2.RageMP131.exe.720000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Code function: 0_2_0064C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_0064C630

Source: initial sample

Static PE information: section where entry point is pointing to: .data

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005B3F49 push ecx; ret	0_2_005B3F5C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA717A0 push 7FA70002h; ret	0_2_7FA717AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA71FB0 push 7FA70002h; ret	0_2_7FA71FBF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA71F80 push 7FA70002h; ret	0_2_7FA71F8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA70F90 push 7FA70002h; ret	0_2_7FA70F9F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA72790 push 7FA70002h; ret	0_2_7FA7279F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA71FE0 push 7FA70002h; ret	0_2_7FA71FEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA70FF0 push 7FA70002h; ret	0_2_7FA70FFF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA727F0 push 7FA70002h; ret	0_2_7FA727FF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA70FC0 push 7FA70002h; ret	0_2_7FA70FCF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA727C0 push 7FA70002h; ret	0_2_7FA727CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA717D0 push 7FA70002h; ret	0_2_7FA717DF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA71F20 push 7FA70002h; ret	0_2_7FA71F2F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA70F30 push 7FA70002h; ret	0_2_7FA70F3F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA72730 push 7FA70002h; ret	0_2_7FA7273F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA70F00 push 7FA70002h; ret	0_2_7FA70F0F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA72700 push 7FA70002h; ret	0_2_7FA7270F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA71710 push 7FA70002h; ret	0_2_7FA7171F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA70F60 push 7FA70002h; ret	0_2_7FA70F6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA72760 push 7FA70002h; ret	0_2_7FA7276F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA71770 push 7FA70002h; ret	0_2_7FA7177F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA71740 push 7FA70002h; ret	0_2_7FA7174F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA71F50 push 7FA70002h; ret	0_2_7FA71F5F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA70EA0 push 7FA70002h; ret	0_2_7FA70EAF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA726A0 push 7FA70002h; ret	0_2_7FA726AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA716B0 push 7FA70002h; ret	0_2_7FA716BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA71680 push 7FA70002h; ret	0_2_7FA7168F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA71E90 push 7FA70002h; ret	0_2_7FA71E9F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA716E0 push 7FA70002h; ret	0_2_7FA716EF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA71EF0 push 7FA70002h; ret	0_2_7FA71EFF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_7FA71EC0 push 7FA70002h; ret	0_2_7FA71ECF

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name: entropy: 7.999628050473961
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name: entropy: 7.991031678374504
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name: entropy: 7.818155657101209
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Static PE information: section name: entropy: 7.990686327893471
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.999628050473961
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.991031678374504
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.818155657101209
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.990686327893471
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.999628050473961
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.991031678374504
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.818155657101209
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.990686327893471

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Stalling execution: Execution stalls by calling Sleep			graph_0-50109
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Stalling execution: Execution stalls by calling Sleep

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Window / User API: threadDelayed 634

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-50122
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Evaded block: after key decision			graph_0-50895
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evaded block: after key decision

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-50479

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe TID: 5968	Thread sleep count: 634 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6860	Thread sleep count: 128 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6860	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7216	Thread sleep count: 86 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7216	Thread sleep count: 42 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8704	Thread sleep count: 174 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8704	Thread sleep count: 102 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 9084	Thread sleep count: 33 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 9084	Thread sleep count: 114 > 30

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_0065D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_0065D2B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_006433B0 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_006433B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00611A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	0_2_00611A60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00663B20 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_00663B20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005B1F8C FindClose,FindFirstFileExW,GetLastError,	0_2_005B1F8C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005B2012 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_005B2012
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_006113F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_006113F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0083D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	7_2_0083D2B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_008233B0 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	7_2_008233B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007F1A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	7_2_007F1A60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00843B20 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	7_2_00843B20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00791F8C FindClose,FindFirstFileExW,GetLastError,	7_2_00791F8C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00792012 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	7_2_00792012
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007F13F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	7_2_007F13F0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

0_2_0065D2B0

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_703cab63ddfc30e52e5285a77dd3d65328718bd_cadc5c4f_ca1ea967-fef8-45d7-a94d-43811e9047c7\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_f7fc5d77e4181bfc8c190387d813954cf99dd80_2d68038f_ba0e7d69-f458-483a-978e-dbc15423d24c\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: MPGPH131.exe, 00000008.00000002.2092950272.0000000001B63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_2181566Dom
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: MPGPH131.exe, 00000008.00000002.2092162134.0000000001A81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWr
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.000000000189B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.0000000001896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000n&
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: RageMP131.exe, 0000000F.00000002.2194242592.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000005F
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: RageMP131.exe, 0000000D.00000002.2101248987.00000000074A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}es=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowswwiV
Source: Amcache.hve.20.dr	Binary or memory string: vmci.sys
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: vmware
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: MPGPH131.exe, 00000007.00000002.2104214514.000000000179A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`c}
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: Amcache.hve.20.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.20.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.20.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.20.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: MPGPH131.exe, 00000007.00000003.2027559370.000000000182C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}JO
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: Amcache.hve.20.dr	Binary or memory string: VMware Virtual USB Mouse
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: RageMP131.exe, 0000000F.00000003.1944329420.000000000155D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: Amcache.hve.20.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Hyper-V (guest)
Source: Amcache.hve.20.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.20.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: Amcache.hve.20.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.20.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000A37000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000A37000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000009F7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000009F7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000A37000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000A37000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000009F7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000009F7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000A37000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000A37000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000009F7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000009F7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Hyper-V
Source: Amcache.hve.20.dr	Binary or memory string: VMware
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: MPGPH131.exe, 00000007.00000002.2104214514.000000000173D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_2181566DpzIzG
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}J65EtqTQ2ruTWZeEW0ke6pZu6LLcKCEPSL9PtJkfCzME
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: MPGPH131.exe, 00000007.00000002.2104214514.000000000179A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: Amcache.hve.20.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001A8A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001553000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: RageMP131.exe, 0000000D.00000003.1868798904.0000000001A9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: Amcache.hve.20.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: MPGPH131.exe, 00000007.00000002.2104214514.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91e
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}es=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowsee
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: Amcache.hve.20.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.20.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.20.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.20.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: Amcache.hve.20.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.20.dr	Binary or memory string: VMware VMCI Bus Device
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<A
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: Amcache.hve.20.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: Amcache.hve.20.dr	Binary or memory string: vmci.syshbin
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: Amcache.hve.20.dr	Binary or memory string: VMware, Inc.
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: Amcache.hve.20.dr	Binary or memory string: VMware20,1hbin@
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: xVBoxService.exe
Source: Amcache.hve.20.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: Amcache.hve.20.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001B68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_2181566Dd":fa'O
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: Amcache.hve.20.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: MPGPH131.exe, 00000007.00000002.2104666258.0000000001865000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b},"signin_last_updated_time":1696333686.296287},"sentinel_creation_time":"13340807286316564","shutdown":{"num_processes":0,"num_processes_slow":0,"type":0},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"subresource_filter":{"ruleset_version":{"checksum":0,"content":"","format":0}},"tab_stats":{"last_daily_sample":"13340807614137712"},"telemetry_client":{"host_telclient_path":"QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHBsaWNhdGlvblw5Mi4wLjkwMi42N1x0ZWxjbGllbnQuZGxs","install_source_name":"windows","os_integration_level":5,"sample_id":57862835,"updater_version":"1.3.147.37","windows_update_applied":false},"ukm":{"persisted_logs":[]},"uninstall_metrics":{"installation_date2":"1696333686"},"user_experience_metrics":{"client_id2":"48ea0ba2-e9bb-4568-92cb-0f42a5c5d505","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":6122,"payload_counter":1,"pseudo_low_entropy_source":1088,"session_id":2,"stability":{"browser_last_live_timestamp":"13340894512964064","child_process_crash_count":0,"crash_count":0,"exited_cleanly":true,"extension_renderer_crash_count":0,"extension_renderer_failed_launch_count":0,"extension_renderer_launch_count":6,"gpu_crash_count":0,"incomplete_session_end_count":0,"launch_count":3,"page_load_count":7,"plugin_stats2":[],"renderer_crash_count":0,"renderer_failed_launch_count":0,"renderer_hang_count":0,"renderer_launch_count":3,"session_end_completed":true,"stats_buildtime":"1628133952","stats_version":"92.0.902.67-64","system_crash_count":0}},"variations_compressed_seed":"H4sIAAAAAAAAAJVYXXPiyA79K7d49qWwmcmSmboPfGWS2iQQTJI7tbuVamxh+sZ0e9ptCJnKf79H/iAQMLP7kDi2jk6rpZZays/GMIyo8eVnoxum41jYuTbL//I3ekn4Mykxi+mChM0MpY0vfzSWKYu7YYW+T+kqJGWl3TT+enMaA5mySl+olUhHo/GEacLi4y5PCdDJRKSWjHwVVmqVU/ACFzqO9ZqVHmlWck7oR0aprSEsDNvTu5AxqK8ldJxj8qmRUUSmm8i+CBa0Xdxf6CSRKh
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1664914507.00000000018AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}^3
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001B68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_2181566D
Source: RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: VBoxService.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: Amcache.hve.20.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: VMWare
Source: Amcache.hve.20.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}J6HEdjEHUub5EtqTQ2dk3wwrCNfruTWZeEqONRrqgXAW0ke6pZXg==_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=*
Source: RageMP131.exe, 0000000D.00000002.2099657926.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2103118221.0000000000907000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2091075481.0000000000907000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098376243.00000000008C7000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2193200592.00000000008C7000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Code function: 0_2_005B8A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_005B8A54

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

0_2_0064C630

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00644130 mov eax, dword ptr fs:[00000030h]	0_2_00644130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_00611A60 mov eax, dword ptr fs:[00000030h]	0_2_00611A60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00824130 mov eax, dword ptr fs:[00000030h]	7_2_00824130
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_007F1A60 mov eax, dword ptr fs:[00000030h]	7_2_007F1A60

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Code function: 0_2_00666E20 GetLastError,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,HeapFree,RtlAllocateHeap,HeapFree,

0_2_00666E20

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005B450D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_005B450D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_005B8A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005B8A54
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0079450D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_0079450D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_00798A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00798A54

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: 0_2_0064C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		0_2_0064C630
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 7_2_0082C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		7_2_0082C630

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_0065D2B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: GetLocaleInfoW,	0_2_005D31B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: EnumSystemLocalesW,	0_2_005CB1A3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_005D32E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: GetLocaleInfoW,	0_2_005D33E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_005D34BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: GetLocaleInfoW,	0_2_005CB726
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_005D2B48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: GetLocaleInfoW,	0_2_005D2D4D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: EnumSystemLocalesW,	0_2_005D2DF4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: EnumSystemLocalesW,	0_2_005D2E3F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: EnumSystemLocalesW,	0_2_005D2EDA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_005D2F65
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	7_2_0083D2B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	7_2_007B31B8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	7_2_007AB1A3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_007B32E1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	7_2_007B33E7
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_007B34BD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	7_2_007AB726
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	7_2_007B2B48
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	7_2_007B2D4D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	7_2_007B2DF4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	7_2_007B2E3F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	7_2_007B2EDA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	7_2_007B2F65

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

0_2_0065D2B0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

0_2_0065D2B0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

0_2_0065D2B0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.20.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.20.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.20.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.20.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000003.1901048371.0000000001983000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1901198665.0000000001994000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2092162134.0000000001A27000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2092743314.0000000001B18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1901048371.0000000001993000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2104666258.000000000186E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2086799247.000000000183E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1997073810.0000000001890000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1996378466.0000000001890000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1996163003.0000000001890000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2027506796.0000000001892000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2025987376.0000000001B61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2104822243.0000000001894000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2087269629.0000000001983000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2104214514.000000000173D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2026230623.0000000001B6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2026205617.0000000001B62000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2092977467.0000000001B6C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2099657926.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2027559370.000000000186E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2025987376.0000000001B16000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe PID: 796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 8700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 9080, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_GC5VU0C8TlDHIYOayOodaC.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\6vITM1PSugWZudEYSR57YQU.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\gWpl3DKIKrL9jhWS6lgcZ2J.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1834968833.0000000001946000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty Extension
Source: MPGPH131.exe, 00000007.00000002.2106455749.0000000007650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet1
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: MPGPH131.exe, 00000007.00000002.2106455749.0000000007650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet1
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json*Y
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsns
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet*
Source: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Livec

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe PID: 796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 8700, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000003.1901048371.0000000001983000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1901198665.0000000001994000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2092162134.0000000001A27000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2092743314.0000000001B18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1901048371.0000000001993000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2104666258.000000000186E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2086799247.000000000183E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1997073810.0000000001890000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1996378466.0000000001890000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1996163003.0000000001890000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2027506796.0000000001892000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2025987376.0000000001B61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2104822243.0000000001894000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2087269629.0000000001983000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2104214514.000000000173D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2026230623.0000000001B6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2026205617.0000000001B62000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2092977467.0000000001B6C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2099657926.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2027559370.000000000186E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2025987376.0000000001B16000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe PID: 796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 8700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 9080, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_GC5VU0C8TlDHIYOayOodaC.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\6vITM1PSugWZudEYSR57YQU.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\gWpl3DKIKrL9jhWS6lgcZ2J.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	12 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Virtualization/Sandbox Evasion	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	50%	ReversingLabs	Win32.Trojan.Strictor
SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	58%	Virustotal		Browse
SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	100%	Avira	HEUR/AGEN.1306558

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Avira	HEUR/AGEN.1306558
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	HEUR/AGEN.1306558
C:\ProgramData\MPGPH131\MPGPH131.exe	50%	ReversingLabs	Win32.Trojan.Strictor
C:\ProgramData\MPGPH131\MPGPH131.exe	58%	Virustotal		Browse
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	50%	ReversingLabs	Win32.Trojan.Strictor
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	58%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://pki-ocsp.symauth.com0	0%	URL Reputation	safe
http://193.233.132.56/cost/lenin.exeXb5?7	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exeot	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exetspX(	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe68.0	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe	100%	Avira URL Cloud	malware
http://147.45.47.102:57893/hera/amadka.exe68.0x	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/go.exe	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/go.execeIdser	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/lenin.exeUs	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exeot	15%	Virustotal		Browse
http://193.233.132.56/cost/lenin.exeka.exbota	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe68.0	15%	Virustotal		Browse
http://193.233.132.56/cost/go.exe	25%	Virustotal		Browse
http://193.233.132.56/cost/lenin.exeka.ex;	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exejaxxwa	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/lenin.exe	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/lenin.exer	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe	18%	Virustotal		Browse
http://193.233.132.56/cost/go.exeisepro_bot	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/lenin.exe	26%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
google.com	172.217.4.46	true	false	high
ipinfo.io	34.117.186.192	true	false	high
www.google.com	142.250.72.100	true	false	high
db-ip.com	104.26.5.15	true	false	high

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/sorry/index?continue=https://www.google.com/async/ddljson%3Fasync%3Dntp:2&q=EgS_YOPbGLbp0bEGIjDNZc3MZHlf1E0orMqnosUmz6W763DCXYHXDGytrbaZJcGJLjun_vRC8GiTovYLXb8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://db-ip.com/demo/home.php?s=191.96.227.219	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://ipinfo.io/widget/demo/191.96.227.219	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YOPbGLbp0bEGIjA9RjS4dnTf9TMc_WNOZoEqYCGZPMusvyHbkcGkBp0b60YgEyf8aWQGPDnoAkT6yZQyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	D87fZN3R3jFeplaces.sqlite.13.dr	false		high
https://duckduckgo.com/ac/?q=	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	false		high
https://t.me/risepro_boteb	RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe	MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://t.me/RiseProSUPPORTl	RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot7.219	MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	false		high
http://147.45.47.102:57893/hera/amadka.exeot	RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://db-ip.com/	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/191.96.227.2190	MPGPH131.exe, 00000008.00000002.2092162134.0000000001A60000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exetspX(	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=191.96.227.219n?x	RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTh	RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/lenin.exeXb5?7	RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.102:57893/hera/amadka.exe68.0	MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1863787047.00000000072D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1857497356.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1960562962.0000000001896000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1954095590.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1955332457.0000000001B86000.00000004.00000020.00020000.00000000.sdmp, ofPO1RwvHkuAHistory.0.dr, FAL14YoTdbqiHistory.13.dr, zJuLTaGAiOucHistory.13.dr, i1yIsS8bZnbMHistory.8.dr, 9cOnGTGkShnWHistory.0.dr, 2HnRxWloJpRxHistory.7.dr	false		high
http://147.45.47.102:57893/hera/amadka.exe68.0x	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=191.96.227.2191s	MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro	RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=191.96.227.219ot	RageMP131.exe, 0000000F.00000002.2194242592.000000000156A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/A	MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/go.exe	MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTV	MPGPH131.exe, 00000007.00000002.2104666258.000000000186E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot)	MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/go.execeIdser	RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=191.96.227.219.outloo	MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=191.96.227.219D	RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	ofPO1RwvHkuAHistory.0.dr, FAL14YoTdbqiHistory.13.dr, zJuLTaGAiOucHistory.13.dr, i1yIsS8bZnbMHistory.8.dr, 9cOnGTGkShnWHistory.0.dr, 2HnRxWloJpRxHistory.7.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	false		high
https://db-ip.com:443/demo/home.php?s=191.96.227.219	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/191.96.227.219hE	RageMP131.exe, 0000000D.00000002.2099657926.0000000001A69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botL#2	MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/#:	RageMP131.exe, 0000000F.00000002.2194242592.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/lenin.exeUs	MPGPH131.exe, 00000007.00000002.2104214514.0000000001730000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/191.96.227.219E	MPGPH131.exe, 00000007.00000002.2104214514.0000000001779000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORT=	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1901198665.0000000001994000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1901048371.0000000001993000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/c	RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORT4	MPGPH131.exe, 00000008.00000002.2092743314.0000000001B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2025987376.0000000001B16000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	false		high
http://193.233.132.56/cost/lenin.exeka.exbota	MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/191.96.227.219S2	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2102864029.0000000000761000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2090843133.0000000000761000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098106504.0000000000721000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2192978530.0000000000721000.00000040.00000001.01000000.00000008.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	false		high
http://upx.sf.net	Amcache.hve.20.dr	false		high
https://t.me/RiseProSUPPORT	RageMP131.exe, 0000000D.00000002.2099657926.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, _GC5VU0C8TlDHIYOayOodaC.zip.8.dr, 6vITM1PSugWZudEYSR57YQU.zip.13.dr, gWpl3DKIKrL9jhWS6lgcZ2J.zip.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1863787047.00000000072D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1857497356.00000000019AD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1960562962.0000000001896000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1954095590.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1955332457.0000000001B86000.00000004.00000020.00020000.00000000.sdmp, ofPO1RwvHkuAHistory.0.dr, FAL14YoTdbqiHistory.13.dr, zJuLTaGAiOucHistory.13.dr, i1yIsS8bZnbMHistory.8.dr, 9cOnGTGkShnWHistory.0.dr, 2HnRxWloJpRxHistory.7.dr	false		high
https://www.ecosia.org/newtab/	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	false		high
https://ipinfo.io/Mozilla/5.0	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018C3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2104214514.00000000017C0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2092162134.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001578000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.13.dr	false		high
https://db-ip.com:443/demo/home.php?s=191.96.227.219r)	RageMP131.exe, 0000000F.00000002.2194242592.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=191.96.227.219QW	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io:443/widget/demo/191.96.227.219	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018C3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2104214514.00000000017C0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2092162134.0000000001AA6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	false		high
http://193.233.132.56/cost/lenin.exeka.ex;	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_bot	RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.8.dr, passwords.txt.0.dr, passwords.txt.13.dr	false		high
https://db-ip.com:443/demo/home.php?s=191.96.227.219P	MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot7.219H	RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botAb	RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/	RageMP131.exe, 0000000F.00000002.2194242592.000000000155F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001594000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000F.00000002.2194242592.0000000001578000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pki-ocsp.symauth.com0	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	false	URL Reputation: safe	unknown
http://147.45.47.102:57893/hera/amadka.exejaxxwa	RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, MPGPH131.exe	false		high
https://db-ip.com/demo/home.php?s=191.96.227.219IuG	MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/lenin.exe	MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp	false	26%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2102864029.0000000000761000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000008.00000002.2090843133.0000000000761000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000D.00000002.2098106504.0000000000721000.00000040.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000F.00000002.2192978530.0000000000721000.00000040.00000001.01000000.00000008.sdmp	false		high
https://db-ip.com:443/demo/home.php?s=191.96.227.219lu	MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.13.dr	false		high
https://t.me/risepro_botb#D	MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	ofPO1RwvHkuAHistory.0.dr, FAL14YoTdbqiHistory.13.dr, zJuLTaGAiOucHistory.13.dr, i1yIsS8bZnbMHistory.8.dr, 9cOnGTGkShnWHistory.0.dr, 2HnRxWloJpRxHistory.7.dr	false		high
http://193.233.132.56/cost/lenin.exer	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=191.96.227.219yUk	MPGPH131.exe, 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1859408154.00000000072E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1864427567.00000000072EC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe, 00000000.00000003.1855947799.00000000019AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1961346965.000000000766A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1944872868.0000000001897000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1953713835.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1959185609.0000000007728000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1955343277.0000000001B8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1951162142.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1961588677.00000000074BF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000D.00000003.1957623496.0000000001B97000.00000004.00000020.00020000.00000000.sdmp, 0K7_4ZPCGxHpWeb Data.0.dr, v2cU2ORgmdjCWeb Data.13.dr, fPrkUqiJIt7RWeb Data.7.dr, jdYGzsyj2RgAWeb Data.0.dr, 7infWL2dpE0JWeb Data.13.dr, 00Qerm5hMGZOWeb Data.8.dr, 2a4LP_xtRLdaWeb Data.13.dr, zbISjRzl0odeWeb Data.7.dr, UI_98ko8uFErWeb Data.0.dr	false		high
http://193.233.132.56/cost/go.exeisepro_bot	MPGPH131.exe, 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.176.196	unknown	United States	15169	GOOGLEUS	false
104.26.5.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
142.250.72.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435791
Start date and time:	2024-05-03 07:22:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@44/85@9/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 58% Number of executed functions: 50 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.72.99, 142.251.35.174, 172.253.122.84, 34.104.35.123, 72.21.81.240, 192.229.211.108, 20.42.65.92, 142.251.40.131, 142.250.65.206
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, blobcollector.events.data.trafficmanager.net, update.googleapis.com, umwatson.events.data.microsoft.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:22:57	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
06:22:57	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
06:22:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
06:23:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
07:23:37	API Interceptor	4x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
239.255.255.250	PO# CV-PO23002552.PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	https://mandrillapp.com/track/click/31140489/aazenterprise.com?p=eyJzIjoiNUJvNUhtZmVHb2F5TEhHSWo4U3JuemNCVDJBIiwidiI6MSwicCI6IntcInVcIjozMTE0MDQ4OSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FhemVudGVycHJpc2UuY29tXFxcL2lucXVpcnkuaHRtbD93aGl0ZT1aR1YyY21sbGJtUjBMbUpsY25SQVpHVnRaUzFuY205MWNDNWpiMjA9XCIsXCJpZFwiOlwiNTQ2NzE3YTVmZjkwNDc2Zjk4NzEyMzQ3MjYwNGUyYThcIixcInVybF9pZHNcIjpbXCI1N2JjZTAyMmU5NDQ5ODNjNzcxODk1ZTUzYThjYmMzZDdhNmZhZmEyXCJdfSJ9	Get hash	malicious	HTMLPhisher	Browse
	https://www.canva.com/design/DAGEBBzq9KM/jvjE01qRbaOyWhWyDOHDeg/view?utm_content=DAGEBBzq9KM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse
	http://kprfamilydoctors.com.au//u0000	Get hash	malicious	Unknown	Browse
	http://www.borneomedicalcentre.com/en/wp-content/themes/eightmedi-lite/js/jquery.bxslider.min.js	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Variant.Doina.72042.21290.22220.exe	Get hash	malicious	Unknown	Browse
	https://kkhh10.z15.web.core.windows.net/merrx01usahtml/?bcda=1-877-906-9710	Get hash	malicious	Unknown	Browse
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	AgentTesla	Browse
	8PiY5IvjhI.exe	Get hash	malicious	Quasar	Browse
	http://www.paviarealestate.com	Get hash	malicious	HTMLPhisher	Browse
104.26.5.15	SecuriteInfo.com.Win64.Evo-gen.17494.7440.exe	Get hash	malicious	Unknown	Browse	api.db-ip.com/v2/free/127.0.0.1
	Nemty.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/84.17.52.2/countryName
	227.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/102.129.143.40/countryName

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
google.com	PO# CV-PO23002552.PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	142.250.176.196
	https://mandrillapp.com/track/click/31140489/aazenterprise.com?p=eyJzIjoiNUJvNUhtZmVHb2F5TEhHSWo4U3JuemNCVDJBIiwidiI6MSwicCI6IntcInVcIjozMTE0MDQ4OSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FhemVudGVycHJpc2UuY29tXFxcL2lucXVpcnkuaHRtbD93aGl0ZT1aR1YyY21sbGJtUjBMbUpsY25SQVpHVnRaUzFuY205MWNDNWpiMjA9XCIsXCJpZFwiOlwiNTQ2NzE3YTVmZjkwNDc2Zjk4NzEyMzQ3MjYwNGUyYThcIixcInVybF9pZHNcIjpbXCI1N2JjZTAyMmU5NDQ5ODNjNzcxODk1ZTUzYThjYmMzZDdhNmZhZmEyXCJdfSJ9	Get hash	malicious	HTMLPhisher	Browse	142.251.32.100
	https://www.canva.com/design/DAGEBBzq9KM/jvjE01qRbaOyWhWyDOHDeg/view?utm_content=DAGEBBzq9KM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	142.250.80.78
	http://kprfamilydoctors.com.au//u0000	Get hash	malicious	Unknown	Browse	142.250.65.164
	http://www.borneomedicalcentre.com/en/wp-content/themes/eightmedi-lite/js/jquery.bxslider.min.js	Get hash	malicious	Unknown	Browse	142.251.35.164
	SecuriteInfo.com.Variant.Doina.72042.21290.22220.exe	Get hash	malicious	Unknown	Browse	142.250.65.164
	https://kkhh10.z15.web.core.windows.net/merrx01usahtml/?bcda=1-877-906-9710	Get hash	malicious	Unknown	Browse	142.251.40.164
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	AgentTesla	Browse	142.251.35.164
	8PiY5IvjhI.exe	Get hash	malicious	Quasar	Browse	142.250.65.164
	http://www.paviarealestate.com	Get hash	malicious	HTMLPhisher	Browse	142.251.32.110
ipinfo.io	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	vEaFCBsRb7.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	hYrJbjnzVc.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	4yFaZU8fhT.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	RY5YJaMEWE.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	OUZXNOqKXg.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	0BzQNa8hYd.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	3CkMJ4UkNy.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	SecuriteInfo.com.Win32.PWSX-gen.8803.13656.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
db-ip.com	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	vEaFCBsRb7.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	4yFaZU8fhT.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	RY5YJaMEWE.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	OUZXNOqKXg.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	0BzQNa8hYd.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	3CkMJ4UkNy.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	SecuriteInfo.com.Win32.PWSX-gen.8803.13656.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	https://herozheng.com/	Get hash	malicious	Unknown	Browse	34.117.152.183
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://wywljs.com/	Get hash	malicious	Unknown	Browse	34.117.152.183
	https://xdywna.com/	Get hash	malicious	Unknown	Browse	34.117.152.183
	https://mandrillapp.com/track/click/30551860/topbusiness.ro?p=eyJzIjoiWmkwVnFVYXdRYlFmYnVnd3Y3OWdtR2h1anpvIiwidiI6MSwicCI6IntcInVcIjozMDU1MTg2MCxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3RvcGJ1c2luZXNzLnJvXFxcL3dwLWFkbWluXFxcL2pzXFxcL3dpZGdldHNcXFwvbWVkaWFcXFwvP2FjdGlvbj12aWV3JjE0MD1jMk52ZEhRdVpHRm9ibXRsUUd4allYUjBaWEowYjI0dVkyOXQmcjE9MTQwJnIyPTE0MCZub2lzZT00Q0hBUlwiLFwiaWRcIjpcImVjMTY1MjE1OWRhYTRjZTA5ZGZhODE5NTEzNzU2Mjg1XCIsXCJ1cmxfaWRzXCI6W1wiOGMyZTc5NjYyNTU5N2FjNDFlODZkYmM4MWMwMjI2MTFjZjYyYTIzMlwiXX0ifQ	Get hash	malicious	HTMLPhisher	Browse	34.117.77.79
	Pots.exe	Get hash	malicious	44userber Stealer, Rags Stealer	Browse	34.117.188.166
	vEaFCBsRb7.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://www.opustrustweb.com/EmailTrackerAPI/open?token=eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0..62tVk07eUS1tgkfaDkQOqQ.nL-JZjGlYSBu9AibCOqK7-wJ7VXqjfoMrgeXwHgP6tLPx4s2jjofEWjZh794Ex5FiocFlK50_YxzembNjUsYkjIjaFyaIpNIDSPFE46cBlrxNy-t9VcCVcfKZphrojE0.AXzXZielor8D6px-r_wTOg&url=https://minicursodamariana.fun/nu/slceitil@emfa.pt	Get hash	malicious	HTMLPhisher	Browse	34.117.77.79
	4yFaZU8fhT.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
CLOUDFLARENETUS	https://mandrillapp.com/track/click/31140489/aazenterprise.com?p=eyJzIjoiNUJvNUhtZmVHb2F5TEhHSWo4U3JuemNCVDJBIiwidiI6MSwicCI6IntcInVcIjozMTE0MDQ4OSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FhemVudGVycHJpc2UuY29tXFxcL2lucXVpcnkuaHRtbD93aGl0ZT1aR1YyY21sbGJtUjBMbUpsY25SQVpHVnRaUzFuY205MWNDNWpiMjA9XCIsXCJpZFwiOlwiNTQ2NzE3YTVmZjkwNDc2Zjk4NzEyMzQ3MjYwNGUyYThcIixcInVybF9pZHNcIjpbXCI1N2JjZTAyMmU5NDQ5ODNjNzcxODk1ZTUzYThjYmMzZDdhNmZhZmEyXCJdfSJ9	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://www.canva.com/design/DAGEBBzq9KM/jvjE01qRbaOyWhWyDOHDeg/view?utm_content=DAGEBBzq9KM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.16.103.112
	SecuriteInfo.com.Win32.PWSX-gen.23212.6828.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	http://kprfamilydoctors.com.au//u0000	Get hash	malicious	Unknown	Browse	104.21.93.126
	SecuriteInfo.com.Trojan.GenericKD.72607091.32716.31681.exe	Get hash	malicious	LummaC	Browse	104.21.53.146
	http://www.borneomedicalcentre.com/en/wp-content/themes/eightmedi-lite/js/jquery.bxslider.min.js	Get hash	malicious	Unknown	Browse	1.1.1.1
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	172.67.189.159
	http://www.paviarealestate.com	Get hash	malicious	HTMLPhisher	Browse	104.22.0.204
	https://www.bjvpza.cn/	Get hash	malicious	Unknown	Browse	104.22.39.239
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	vEaFCBsRb7.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	hYrJbjnzVc.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	KhbShPK91I.exe	Get hash	malicious	Unknown	Browse	193.233.132.56
	4yFaZU8fhT.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	RY5YJaMEWE.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	MejqsB9tx9.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	OUZXNOqKXg.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	0BzQNa8hYd.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	PO# CV-PO23002552.PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	23.51.58.94 52.165.165.26 40.126.24.82 20.12.23.50
	https://mandrillapp.com/track/click/31140489/aazenterprise.com?p=eyJzIjoiNUJvNUhtZmVHb2F5TEhHSWo4U3JuemNCVDJBIiwidiI6MSwicCI6IntcInVcIjozMTE0MDQ4OSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FhemVudGVycHJpc2UuY29tXFxcL2lucXVpcnkuaHRtbD93aGl0ZT1aR1YyY21sbGJtUjBMbUpsY25SQVpHVnRaUzFuY205MWNDNWpiMjA9XCIsXCJpZFwiOlwiNTQ2NzE3YTVmZjkwNDc2Zjk4NzEyMzQ3MjYwNGUyYThcIixcInVybF9pZHNcIjpbXCI1N2JjZTAyMmU5NDQ5ODNjNzcxODk1ZTUzYThjYmMzZDdhNmZhZmEyXCJdfSJ9	Get hash	malicious	HTMLPhisher	Browse	23.51.58.94 52.165.165.26 40.126.24.82 20.12.23.50
	https://www.canva.com/design/DAGEBBzq9KM/jvjE01qRbaOyWhWyDOHDeg/view?utm_content=DAGEBBzq9KM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	23.51.58.94 52.165.165.26 40.126.24.82 20.12.23.50
	http://kprfamilydoctors.com.au//u0000	Get hash	malicious	Unknown	Browse	23.51.58.94 52.165.165.26 40.126.24.82 20.12.23.50
	SecuriteInfo.com.Variant.Doina.72042.21290.22220.exe	Get hash	malicious	Unknown	Browse	23.51.58.94 52.165.165.26 40.126.24.82 20.12.23.50
	https://kkhh10.z15.web.core.windows.net/merrx01usahtml/?bcda=1-877-906-9710	Get hash	malicious	Unknown	Browse	23.51.58.94 52.165.165.26 40.126.24.82 20.12.23.50
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	AgentTesla	Browse	23.51.58.94 52.165.165.26 40.126.24.82 20.12.23.50
	8PiY5IvjhI.exe	Get hash	malicious	Quasar	Browse	23.51.58.94 52.165.165.26 40.126.24.82 20.12.23.50
	https://sites.google.com/view/1017-docu-meusnme-office-ru/home	Get hash	malicious	Unknown	Browse	23.51.58.94 52.165.165.26 40.126.24.82 20.12.23.50
	https://docs.google.com/drawings/d/1ir0TPTFrA2ZlsddUs_9uV_uLa1D8P2cUzCHWO0EIr4E/preview	Get hash	malicious	Unknown	Browse	23.51.58.94 52.165.165.26 40.126.24.82 20.12.23.50
a0e9f5d64349fb13191bc781f81f42e1	SecuriteInfo.com.Trojan.GenericKD.72607091.32716.31681.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15 34.117.186.192
	2024 12_59_31 a.m..js	Get hash	malicious	WSHRAT	Browse	104.26.5.15 34.117.186.192
	Dadebehring PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	104.26.5.15 34.117.186.192
	PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	104.26.5.15 34.117.186.192
	Update on Payment.js	Get hash	malicious	WSHRAT	Browse	104.26.5.15 34.117.186.192
	deobfuscated.js	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	deobfuscated.js	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	GLAS_DeploymentMatrix_Full_26694_20240502_075604.xlsm	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3197440
Entropy (8bit):	7.973137564039597
Encrypted:	false
SSDEEP:	49152:vXXEVscFrenB6teP9akEurndc2IWBvXBcu2C3EOeZFvb0mLnAycFXd/En/8SdE7h:vnEicenY8sburUW5Xb2CM3k1BakSi7k
MD5:	8D6E0FA54DF379D380222A4051AB848C
SHA1:	AAF9A4B13C41BEB62D8B40440A37E999C512A33A
SHA-256:	BC85F6C9D136388898852A62309EEF10A34B3118FD024281E14E468594C2FF9F
SHA-512:	650CDC9CE136F8DD3A324A92571BE5309C86E25ED40C463FE2FF6161723EB056D50FCB3DC0F5F1941316CE9F411EEA5C67988EBF3B0B3037477E94AF7A7119A6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50% Antivirus: Virustotal, Detection: 58%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y...s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L.....2f...............'.........................@......................................@... .. .... .. ..........P.......l...............................0..........................................................................................................................@.......................................@............P... .......0..............@................p.......8..............@................ ...`...8..............@....rsrc...............................@..@..........y..p...(...H..............@....data....`"......Z"..p..............@...................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_234a68b484188ee7734158a9c3c1f48d2f1fcf9_2d68038f_092f1c61-e679-4284-adf0-35641287d6cd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0910222827179215
Encrypted:	false
SSDEEP:	192:z4lwypzU8Dv0N/yI6E6jjYZrSruBF9zuiFeZ24IO826t:0wwUecN/yXjC9zuiFeY4IO8p
MD5:	0975F26C2B655E260F3E50F96BEB8C21
SHA1:	04D9A034D090BFD0B1F7028E4B681C96951E85CB
SHA-256:	C553AFD442F020B59C2B4872DB8BA8404040C7FAB42A58C60ACFF3F27749E966
SHA-512:	2444775E1AE44F14DD64348356CCE5A361937630B5D941BB4244CEA28744CCB475BE9F778EB84F145DFE1CC586E7A35A7DFAE5A4D8FAAD35B6BF2ECE63B89800
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.1.8.7.4.1.2.5.9.7.4.7.3.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.1.8.7.4.1.3.4.2.5.1.8.5.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.9.2.f.1.c.6.1.-.e.6.7.9.-.4.2.8.4.-.a.d.f.0.-.3.5.6.4.1.2.8.7.d.6.c.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.f.5.2.e.d.c.a.-.8.9.c.8.-.4.b.5.6.-.9.5.3.2.-.b.8.2.e.c.6.0.c.8.a.4.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.r.o.s.s.D.e.v.i.c.e.S.e.t.t.i.n.g.s.H.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.8.4.-.0.0.0.1.-.0.0.1.4.-.c.f.5.a.-.2.5.f.5.1.9.9.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.6.7.a.b.c.f.8.d.6.c.2.5.2.9.7.e.d.9.7.2.3.e.f.1.6.c.3.8.f.3.6.0.0.0.0.0.9.1.0.!.0.0.0.0.a.a.f.9.a.4.b.1.3.c.4.1.b.e.b.6.2.d.8.b.4.0.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_f7fc5d77e4181bfc8c190387d813954cf99dd80_2d68038f_ba0e7d69-f458-483a-978e-dbc15423d24c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.084061562094046
Encrypted:	false
SSDEEP:	192:+wUl/pz78DZ07ErhN6E6jjTZrlyLB+EzuiFeZ24IO826t:10F7e67ErhAjNEzuiFeY4IO8p
MD5:	8DF1AB5150CDD2CF6A41E3F805C54B94
SHA1:	04507B31D031CBAF1A3AB1E0A1A5F181081DE7F8
SHA-256:	6BC398211E820F23F87BDE25AFB40BF0BDDA8AEE38FA875FDAF2DBC8CAB302FE
SHA-512:	AF949CCEA7CE940EC972EFFCE23D861700E04B8FBDBB3C372EEF681DF79CFA9EDC4AF67A07221704DE270CD6A2BE9F12CE6BF4A1D562E48C9569239CA21667BD
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.1.8.7.4.1.2.1.4.9.1.1.5.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.1.8.7.4.1.3.1.1.9.4.2.5.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.a.0.e.7.d.6.9.-.f.4.5.8.-.4.8.3.a.-.9.7.8.e.-.d.b.c.1.5.4.2.3.d.2.4.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.6.8.f.b.c.0.d.-.7.3.2.5.-.4.a.c.0.-.b.d.e.1.-.a.6.5.1.a.4.7.0.9.3.8.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.r.o.s.s.D.e.v.i.c.e.S.e.t.t.i.n.g.s.H.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.2.c.-.0.0.0.1.-.0.0.1.4.-.d.f.8.0.-.4.e.f.5.1.9.9.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.6.7.a.b.c.f.8.d.6.c.2.5.2.9.7.e.d.9.7.2.3.e.f.1.6.c.3.8.f.3.6.0.0.0.0.0.9.1.0.!.0.0.0.0.a.a.f.9.a.4.b.1.3.c.4.1.b.e.b.6.2.d.8.b.4.0.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_c38d378e10faade69745bd4221c06297b5b1c26_d8abc321_c45c5e10-8fde-4227-81f3-86e9161f7cf4\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0967366128563727
Encrypted:	false
SSDEEP:	192:ZWVBZ0+0Mpw4jYZrSruBF9zuiFeZ24IO8i:kVP0lMpw4jC9zuiFeY4IO8i
MD5:	6C19162A32208492C6C8CB75C5E61D6D
SHA1:	9C4B786103ABA88BD4C7AB00429DFD2E9CB1FC87
SHA-256:	C6FF3AB35A8CD1DC03185C2D0A88C55E517CD8D45172FEB176C03F5D6D5DEB79
SHA-512:	DBEC33C0217EC9A156559E5E0D7D7FD4DADC73863235F91046DACCD509C33215E2AEC94A8D79AD4D8AF9386B990D3568050697E9CD8AB226571967A959A604F8
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.1.8.7.4.1.2.1.3.8.0.8.1.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.1.8.7.4.1.3.1.3.9.5.1.7.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.4.5.c.5.e.1.0.-.8.f.d.e.-.4.2.2.7.-.8.1.f.3.-.8.6.e.9.1.6.1.f.7.c.f.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.e.d.1.d.4.7.e.-.9.e.5.1.-.4.2.7.2.-.a.4.b.3.-.e.5.d.2.b.9.2.6.e.b.c.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.a.g.e.M.P.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.r.o.s.s.D.e.v.i.c.e.S.e.t.t.i.n.g.s.H.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.2.1.f.c.-.0.0.0.1.-.0.0.1.4.-.8.5.5.4.-.2.a.f.d.1.9.9.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.6.7.a.b.c.f.8.d.6.c.2.5.2.9.7.e.d.9.7.2.3.e.f.1.6.c.3.8.f.3.6.0.0.0.0.0.9.1.0.!.0.0.0.0.a.a.f.9.a.4.b.1.3.c.4.1.b.e.b.6.2.d.8.b.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_703cab63ddfc30e52e5285a77dd3d65328718bd_cadc5c4f_ca1ea967-fef8-45d7-a94d-43811e9047c7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1217388366049412
Encrypted:	false
SSDEEP:	192:5kGPe9N0PmPljYZrSruVzfzuiFeZ24IO8w:mGW9OPmPljAfzuiFeY4IO8w
MD5:	38BFCA56FD9225AF8DB5E3DC0C5AD605
SHA1:	1124907654E2C377F45D334935504582CA139028
SHA-256:	F7F0523082C895B53C17AFDC3C6B7FE5E931BB42296BFC624823A7CE1940F3FA
SHA-512:	245BC16E083E8F0BADB6DED196E058A2E9239966AC0F029192A403AEA0157D9F540D238A983003102B38FCD26BFD790C1C6BC016277C9C9416E1B64ECF059D1D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.1.8.7.3.9.9.9.6.7.9.1.1.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.1.8.7.4.0.4.6.4.6.7.0.9.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.a.1.e.a.9.6.7.-.f.e.f.8.-.4.5.d.7.-.a.9.4.d.-.4.3.8.1.1.e.9.0.4.7.c.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.9.0.3.9.2.3.c.-.3.5.b.6.-.4.9.0.b.-.b.a.f.3.-.8.8.6.1.d.6.d.8.e.5.d.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.3.2...P.W.S.X.-.g.e.n...1.1.7.3.9...1.6.9.8.0...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.r.o.s.s.D.e.v.i.c.e.S.e.t.t.i.n.g.s.H.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.3.1.c.-.0.0.0.1.-.0.0.1.4.-.6.7.f.8.-.d.e.f.1.1.9.9.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.6.7.a.b.c.f.8.d.6.c.2.5.2.9.7.e.d.9.7.2.3.e.f.1.6.c.3.8.f.3.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER713D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri May 3 05:23:20 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	117480
Entropy (8bit):	1.9637804133964445
Encrypted:	false
SSDEEP:	384:Vomepqk+ue6NWWWWlTl5nzU1Zk+0Kuck4YlgFytRUxiVD8h0eWArRGrChVNP4Edq:gp4ue6vzn5FmbluUwE/JQ
MD5:	41A2A972CCDF3E7F777E23DC085A0403
SHA1:	34C7B760016CED6A3B7B3ECC12E5179EACEFB152
SHA-256:	409BB60ED8CEAE3CBED36B60BE0F3D0AE35D330A48DA321FA226F649D9F2BC6D
SHA-512:	9450FA4F8F77B0747F731ACBAE8E02131E58229FFF63DD0FAF48179ADFAEF9A551DE427D9408780C99517AED9DF089994524EC33874F7B002600B26A61043441
Malicious:	false
Preview:	MDMP..a..... ........t4f........................H...(.......l...p%..........`R..........`.......8...........T...........hM...}...........%...........'..............................................................................eJ......`(......GenuineIntel............T............t4f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER72D4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	8528
Entropy (8bit):	3.7097590257645754
Encrypted:	false
SSDEEP:	192:R6l7wVeJln6DD6Y9ySUMg1ctgmf9JJA4prN89bGssfXim:R6lXJ16H6YoSUM7tgmf9JJQG/fj
MD5:	B9AB93AC0E405FBE001775AA302BDA2D
SHA1:	8A0BD87125347A77FA44A2BB525858596A6980C8
SHA-256:	D9E01B1160437FA92D8475D37252BA309D6230DFBCECC5653625AFB14E10FD95
SHA-512:	3E192B4B5C9102BC0709D08E84B396F2B606226279733308A43B47E8C0EFD42775B27173940E9A8D20A2E4A86CA2988960F051ACC4E58998BE30F407E29A192E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.6.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER73DE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	4.600488072825972
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI9J2WpW8VYmPYm8M4JEAwAwNiFF+q81A+vuDisAzblAzofd:uIjfAI7fX7V2JCqI0i1bEmd
MD5:	43CFBE280CC8217F17A2E151C5B5E169
SHA1:	843FC127E9BDB486668B75B89C25B99ED9B59B06
SHA-256:	09B71F1F66403D89049CFA7AE84773F2D54865E7E6F418C1B799CA78A6F28EBB
SHA-512:	5ACA279899B171A8E130CE381EE9E64A9024099252A58BFCA56D84567E10EDE4FFA994A064817F39DAE817131E126813C8298DDCB9D6A2B99C7A5B04A4DB0538
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="306506" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0F7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri May 3 05:23:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	121228
Entropy (8bit):	1.9159956001009852
Encrypted:	false
SSDEEP:	384:Aah0dacVBTFue6o/kngAl8iwfT/THqKsYOlHLYRMgIm+nuPv0/F7K7:RK7ue6kqfwruYIHbp9M0/m
MD5:	09B5B1D4C20DB23E3E6A290D4A931B64
SHA1:	418451C06552E7C53CB84A00F2B9B1DA592617F6
SHA-256:	42523A9B389DBFDA417F2929AE5F0EF7FF0107D87AF35A5EE3D6313FF46537FF
SHA-512:	AC126ACA0C76B6B3D07BE1F0793A03B45549C2C2C1C33A7D43BE5F6E8CD35B0C12059BD76C88915DCEBD40C87C25937509DF9AAF6541985BA29C999A76A531DD
Malicious:	false
Preview:	MDMP..a..... ........t4f........................H...(.......l...p%...........R..........`.......8...........T............L...............%...........'..............................................................................eJ......`(......GenuineIntel............T........!...t4f............................. ..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA126.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri May 3 05:23:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	128442
Entropy (8bit):	1.8551917056790512
Encrypted:	false
SSDEEP:	384:w8KDNAmYwSe6/r9bltDvrNYp7+LKZwvLcqybag2Oe4DBeQ+e7rWkVZPX:vcem/Se6/JblVve6T0RgHkz/
MD5:	4FE30D265AC750ECCFB5099D1D6674C2
SHA1:	15883B80315FD09A69C7D5D4039D20623D122BD3
SHA-256:	2D7D5410DD1C7AB2F29FF70BF852A28454761063AC5BF19EA6A1DC732CC7769D
SHA-512:	F05F4D33ACD7E1BE43A7F8A851B416077347846D9397380947A8AF652E75E6250F0827C0E83DBD4D29D6B7A8E171E1C9FDB82CD5E65EF8BC4BEE132838AC538C
Malicious:	false
Preview:	MDMP..a..... ........t4f............D...............X.......l...4%...........T..........`.......8...........T...........`K..Z............%...........'..............................................................................eJ......$(......GenuineIntel............T.......,....t4f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2BC.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri May 3 05:23:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	129974
Entropy (8bit):	1.8403927437679877
Encrypted:	false
SSDEEP:	384:GOTvq0omm6atue6z7PXaCg7dHXBkFOL9eWI4HNtAcDfIpszZuEwf:HTiBmGtue6PC7ZXBkFO4OvBksM
MD5:	5983ADEE814E3D822765BF0022A3C72E
SHA1:	6F6B8EF17D5D1F9A3EAFEB482119AA7E9BC42CD9
SHA-256:	F86C3BFA866F2956319FFD9EF6E8E5D0586EA7CCA3CA550FA9FFD38CDAB4CA2E
SHA-512:	20487ECC65C0A2232611ADE028EE122BAD4D5FE4AFC0152048EAE21AC946184D21E40E846C38AF79E48952173D409B6661EE029A9768051B4A2F85EFC19EE0A2
Malicious:	false
Preview:	MDMP..a..... ........t4f............D...........H...X.......l....%...........U..........`.......8...........T...........xL..>............&...........'..............................................................................eJ.......(......GenuineIntel............T............t4f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2BD.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.706245061405053
Encrypted:	false
SSDEEP:	192:R6l7wVeJS0S60G96Y9JSUyMcMgmfdJJDprQ89bFhsf33m:R6lXJSp6z6YTSUydMgmfdJJDFafm
MD5:	29E3F31BB67DA26F9D37D4E09C774379
SHA1:	C9CB8629441BFD5591F71D20A09AC4EA4B66579A
SHA-256:	F7EFF1DDC19471C466A583EBC9F93A09B0029FC25A21DEB5F3A9BD95A8BFAB16
SHA-512:	70264D98A3B6BBFC34F226C79938724A0D2ACA73D693C0DAE156FCAAE1C0BB9B6B9C7C5D5297B9178AD65E21A5E29C28D5AF6DB9694D189286C46CC133811175
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.7.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2DD.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6370
Entropy (8bit):	3.732558420223259
Encrypted:	false
SSDEEP:	192:R6l7wVeJ/ub6pUfYiBJJHcprT89bFDsfc3m:R6lXJS6QY6JJH9FofR
MD5:	69CA03598D72B6573AB257FDC6D5E10D
SHA1:	DF1C9518D39A707FC6E720711DF0BCC2F38141B1
SHA-256:	C714FA770F2A764FCF469DFD25D8D3887FC6CD9F21ACC8D7F3B99BACCD7AD6A8
SHA-512:	A61A4C1C56A4667D19B61FD5EE5D93D3D25E1F38017B3B33D1C35225BAEE2BD81D81D7B3B9EA21FA23C01F9527B2FA8FE449D06E9130C21CE6BCD6276E3F1DC8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA31C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4713
Entropy (8bit):	4.523855432448344
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI9J2WpW8VYgYm8M4J8tiFQqu+q8svUubtpfd:uIjfAI7fX7VQJgquwubtNd
MD5:	A735705F10EFF1487D421D56D7C45444
SHA1:	4DD7C41B6BC98696DB7604BDD6FDF791F465D5C8
SHA-256:	86397FCA18F4A7DBF4D9E8785131CCE6092ECB678CF782CAB4237805D5F20BAE
SHA-512:	A70CE828882235F9DE834FDAFC88E9DB7530B415993D1585A7E49D6A18C639FC3B75D8C5ADA98F8AA9B148E92C60D12485F6929FEFDAB9B62DFBD76882670C95
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="306506" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA32C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4718
Entropy (8bit):	4.517175047626757
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI9J2WpW8VYHYm8M4JqfFC+q8dONobJEfd:uIjfAI7fX7VzJ7lobJid
MD5:	F488D00C83474DE13A72DC5EB98E9DCC
SHA1:	2B230F28CACFB06F99802DA2E7B8F98847A0AB97
SHA-256:	C9C69C9E9A95DD8DA104337C6DA9A7CBC630CFEC4A2BC295FDE4F8DC496F4DD9
SHA-512:	294CE9EA272FE5DC9AA54BA19F208C2386098991B6E856FC8E0AA415EB836D8D5CAE1FA41FEB037A4A8AE616006E58EF998CEF5E357053FDD6BA4F0297B003AB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="306506" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA4D1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6370
Entropy (8bit):	3.7353540809696306
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbPIuf6AddPoYiLGQXJJ+7PgaM4Uv89bhq9sfwbom:R6l7wVeJQuf6FYi3JJzprv89b89sfw0m
MD5:	9D861F85B07F2AE44A33CAB93AAFC99E
SHA1:	9D4F85AAC57C14360AD6C39D14B4D0DBE7775271
SHA-256:	4FA8A2DD9A5FBEA66CBC94D2753ED1E68C9306D51F4B6497CAEBB1934E068FED
SHA-512:	E195AA774B708FCDBDBD89E1BFC764F7560B54F35E6C16418A6F279DCC70ED1051E0ADAD4DA5D21C0962F35AD37ABC91FBB83FD943A290C7EC6FE015F2985B9E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA510.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4713
Entropy (8bit):	4.5261125265506825
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI9J2WpW8VYyYm8M4J88zFDT+q8ZYQubtwfd:uIjfAI7fX7VeJfZTqBubt+d
MD5:	B13F517A9C96D46ABD90EA912E9A2ED1
SHA1:	EEF56406F4202B2D702A16C72A356C261508D466
SHA-256:	807AB1ED098AF42A9F11B7B76FA68C152B7644CAD748D3D460B2C443D5DF19BE
SHA-512:	D8C234CD2F66544024E604FC2E66065B54738316F9A2FF41B9F4534B9958D1CA613B56B56708BEC144AF24547A43D3F416841CE751A110BE383BBDE3692AF823
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="306506" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3197440
Entropy (8bit):	7.973137564039597
Encrypted:	false
SSDEEP:	49152:vXXEVscFrenB6teP9akEurndc2IWBvXBcu2C3EOeZFvb0mLnAycFXd/En/8SdE7h:vnEicenY8sburUW5Xb2CM3k1BakSi7k
MD5:	8D6E0FA54DF379D380222A4051AB848C
SHA1:	AAF9A4B13C41BEB62D8B40440A37E999C512A33A
SHA-256:	BC85F6C9D136388898852A62309EEF10A34B3118FD024281E14E468594C2FF9F
SHA-512:	650CDC9CE136F8DD3A324A92571BE5309C86E25ED40C463FE2FF6161723EB056D50FCB3DC0F5F1941316CE9F411EEA5C67988EBF3B0B3037477E94AF7A7119A6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50% Antivirus: Virustotal, Detection: 58%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y...s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L.....2f...............'.........................@......................................@... .. .... .. ..........P.......l...............................0..........................................................................................................................@.......................................@............P... .......0..............@................p.......8..............@................ ...`...8..............@....rsrc...............................@..@..........y..p...(...H..............@....data....`"......Z"..p..............@...................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\6vITM1PSugWZudEYSR57YQU.zip

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5626
Entropy (8bit):	7.902390321107444
Encrypted:	false
SSDEEP:	96:RWGzqeAoMq+YK0KF8cAJiI2i+ux0eW9K0Z0WaJCycHyBBRGQdi+3KJB:VqASpF8wFLeiVKWaCyc6y+6JB
MD5:	12C1998EE283605E3EB36D6AB5A8EBF7
SHA1:	045FE33B49F8A1487DCB3BA08DFA6BFD331B18B8
SHA-256:	3CD87E3B2932A09C7E99FED995D903B8E15410BAB8B2624AE44D0FFDFD7651EF
SHA-512:	C204CE548C1C0C6035C4ABA31801BB1442A64A53702468179E367EA240758BF6BEA9A8E2859F3E635B5FEE09862D4EAA9B0480223F2B65D4E9ADF80D4298FAEB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\6vITM1PSugWZudEYSR57YQU.zip, Author: Joe Security
Preview:	PK.........:.X................Cookies\..PK.........:.XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\_GC5VU0C8TlDHIYOayOodaC.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5699
Entropy (8bit):	7.896473259567238
Encrypted:	false
SSDEEP:	96:DUT29vHz9WQBavDziBP1Pe4McobRHSI+cKGOujkbfxKaWmvDmsP833KJQ:DUT29Hz9WGFh1Pe4q46Kf9bfxhW+mQOJ
MD5:	4BDB2E0A00C655BC40D5EBAF6E15CEEC
SHA1:	1DD9AAF826D636A137A75ACE8A00F672231D62CB
SHA-256:	ABEF540C4EBF9917309375049424CAC827F0F6580D0736140ED15E61DF2042B9
SHA-512:	AA393FA107AF89AFA932B4495BECDA512B9E241E7EE0CF2698AC5CDA14D624A5232A240D3F264F602241ED3F143DC5BC4B6FE9F38FC29C880FED47A40E9B0DC4
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\_GC5VU0C8TlDHIYOayOodaC.zip, Author: Joe Security
Preview:	PK.........:.X................Cookies\..PK.........:.X..s@..../......Cookies\Chrome_Default.txt.G.....5..G.BMx.....%.M...{...?.LH..71.t.....:y3..s./.0.m.%......../. ..!..A.C.........;...x...........!.2.....Z..<....<.h8..<.q;.....9....gK.}.R.#f...A.E...1...?lR....b.....nS=l.%E&'...>x......h.......E)C..t..'.2<Z_@.........&Lk......0..B.mqk.9M1lf.-e@....E.v..R&..\|..-....C.w.Y.K... ........k..3..2W5.!vs.....S.~.......0._.*..e.....U...).....>...g+;...z[Ks....Z..d...\|.".v..(...I....+.7.y.X@.H....eV.............Y..c..x...Kw.'S>.d\|.....B..k.p..\|C\|F.......O52....`f.3W..../....i..E...7..c.Kwv..,]..C..j.2.T..+............t.2....6.M>..s..K.M...VJ..>;.......n.<f;]s.K..5...n....~$ ....%......Z#.....Q5...<n...I&......0<:..>..I.K)g.)..KX.H.(Y!..j4W.j..1.V..d\.T..,p...D...T..>z...,.....L.....Mh.t..!....A...!?.U...x..[a7j.N;#..t.\.#.Z.-)f...v_.<..?..`.D0..?......).vX.#...Lw.j...1.....M.#...+.W....h....U.W....G.w......'.Y?.....;.....`...X...C..w..

C:\Users\user\AppData\Local\Temp\gWpl3DKIKrL9jhWS6lgcZ2J.zip

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5603
Entropy (8bit):	7.904707576211243
Encrypted:	false
SSDEEP:	96:wH8WGzqeAoMq+YK0KF8cAJiI2i+uWS+yFzjt7R6Dfg3OG3KJ5RzOt:tqASpF8wFfi596+H6Jc
MD5:	46C5A1C49BACF8CD0FEA2C0E29BA7D5F
SHA1:	B9BA284F5189CA8959F2B3F05F01A772B5830FC2
SHA-256:	10A23D71EF01C1C3152E25D04ABA9E3DC71A3420AF3DA035306AEDFC573A0483
SHA-512:	A9F85B83D99FEBF3204A5B65E36EF829B923F8CD3AA53790444F1857C1F79E5797ED2A4F7B97CF26551515AC8AFFD7C95BE76485F6C71D770CCC9960F4E1CFD2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\gWpl3DKIKrL9jhWS6lgcZ2J.zip, Author: Joe Security
Preview:	PK.........:.X................Cookies\..PK.........:.XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.449311833026446
Encrypted:	false
SSDEEP:	3:LvFXTpn:pNn
MD5:	2B2077B2928022F38886DB0FC7600EFE
SHA1:	0B2DCB324949CDDD2DF615EAB9D3DB6FD39256D6
SHA-256:	97B3620EC799D4357AC43FAD062974CD021F21BF8EF5B3EE13E023BD4223D48A
SHA-512:	18BAE014F93378A7D6364F8DAB11370E043DA07C8369E5711100084EB3FF88841A1B2A0E5176CF4018AD45E80AFE76F92308189611DE172E9BD152227622D109
Malicious:	false
Preview:	1714720260712

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\00Qerm5hMGZOWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\2HnRxWloJpRxHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\7ibVfOWFZmYgCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\BhdF3peWZ8fDWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\EL3MdOIyyqKgHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\HoyMk7Hm8HKeWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\PQaNvpNdlCcNHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\TgQ4S6c4BAPSLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\fPrkUqiJIt7RWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\i1yIsS8bZnbMHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\jDDay9fAZ27tLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\lq_FzBPDtiFFLogin Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\oqtF7Wr83gO8Web Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span0OWCnipDVXAW\zbISjRzl0odeWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\0K7_4ZPCGxHpWeb Data

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\3QUvDHLQIpPQHistory

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\8vdkeD2saVbHLogin Data

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\9cOnGTGkShnWHistory

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\IzCsjzm3CcKuLogin Data

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\J0sWIHsIkGHTWeb Data

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\KschALC58KiLLogin Data For Account

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\ThIg7B_auiTHHistory

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\UI_98ko8uFErWeb Data

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\dzUtof_Rrg2ECookies

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\gHpDxztGM2ghWeb Data

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\jW0rcT_5J3lyWeb Data

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\jdYGzsyj2RgAWeb Data

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanUfhewXukFAeX\ofPO1RwvHkuAHistory

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\2a4LP_xtRLdaWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\4t8dExv_LQdMWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\7infWL2dpE0JWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\9JNno5wiVu1XCookies

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\FAL14YoTdbqiHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\FbUnNuCw4_bKLogin Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\FwanxoY0CagqHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\IeONn8JkiDm1Login Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\emvi1AuFmRezLogin Data For Account

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\i2J5b3z7gLf2Web Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\s8bxXxQRUwKxWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\v2cU2ORgmdjCWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\zJuLTaGAiOucHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spandBSgyOXmoj0v\zwkX_OnYAPDqHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy0OWCnipDVXAW\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	12170
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	192:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WhHGYUnOTNC5IcXkWFXZQHRFJ5Pts7c3aP:gwsPbtKvCpqq40wsPbtKvCpqq47
MD5:	B6F52D24FC4333CE4C66DDA3C3735C85
SHA1:	5B69F1D66E95EFE2CF1710E9F58526B2AAEC67E4
SHA-256:	0FEE1A764F541EC6733DB89C823296650F6E581CD7D812D5A142B5A0AD9BC9B6
SHA-512:	CD2C6D64083061D7C7A7E89CF9C9F7D2B66301C73CFB56D2CCD94D1B810DE42774DAE5B77DB2E567A26FC54989C04D8A60D76225E6F3F91FCD2AE4D2E01F3C4C
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixy0OWCnipDVXAW\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	5666
Entropy (8bit):	5.281262115084655
Encrypted:	false
SSDEEP:	96:xm2GxRRoCcT4Aisph+9hcmInv50WkvEzSvjANUbg3x:xSDCCvAtphWhcmIv5IY7B
MD5:	7DB2402732B7AAF7A00F86F6684B0E02
SHA1:	D5A96A6DCAD5BA51A78B5A68FA7046E01FB91716
SHA-256:	E5C96D2E88DDA7173B1A44C02470688C999227B0D845E500F388FCAA1648067E
SHA-512:	FADB20E25AF4A69AE94146E26B07EA455BD53EC138B6612166F2BCF6B241D0E0C692F8A4E904109FB7858AC3924990B5A7879A8B1A04B89E1E807D632E9FF4D0
Malicious:	false
Preview:	Build: dilda..Version: 1.9....Date: Fri May 3 07:23:28 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 870554ee6dfe065d5ee5bde314dc5f7f....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy0OWCnipDVXAW....IP: 191.96.227.219..Location: US, New York..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 936905 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 3/5/2024 7:23:28..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe [784

C:\Users\user\AppData\Local\Temp\trixy0OWCnipDVXAW\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyUfhewXukFAeX\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyUfhewXukFAeX\information.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	5645
Entropy (8bit):	5.274062728056437
Encrypted:	false
SSDEEP:	96:xmSgRRoGcT4Aisph+9hcmInvuS0WkvEzSvtANUbg3x:xGCGvAtphWhcmIvuSIYrB
MD5:	BBA994068534B4A4FEA06D85E118B89A
SHA1:	CC5349EFBC06FB42D5BCE08CFA4F04BA64708A55
SHA-256:	6B241CF1D03ED6A35E3EB575F1CA71BEF45B8C2151C3A07BB7F68E307A71CBDD
SHA-512:	CE2CF582CD1AB2B3D1B16FDD26A5274E59EEAFF2302C17AA7E5235D263CDBA8502D9D751B21E50EA3671D8D96EB371203CB406F28EB17A9243978A03BE6290A4
Malicious:	false
Preview:	Build: dilda..Version: 1.9....Date: Fri May 3 07:23:15 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 870554ee6dfe065d5ee5bde314dc5f7f....Path: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyUfhewXukFAeX....IP: 191.96.227.219..Location: US, New York..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 936905 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 3/5/2024 7:23:15..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvho

C:\Users\user\AppData\Local\Temp\trixyUfhewXukFAeX\passwords.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixydBSgyOXmoj0v\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixydBSgyOXmoj0v\information.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	5687
Entropy (8bit):	5.28434430735919
Encrypted:	false
SSDEEP:	96:xm2lORoCcT4Aisph+9hcmInv50WkvEzSvjANUbg3x:xwCCvAtphWhcmIv5IY7B
MD5:	948BA1B8DF1C3F234A9D90A7D72B1D53
SHA1:	F084A7C24D6FB7A365A56CD2C3672EECF537905E
SHA-256:	9667FB2B9CD41A7BB5660FEB9E29B597C369FEA0270EDF5B01476F6FF46BAE44
SHA-512:	831D1FD4239077C336B4F486C841E11BAB849EB8D4B340503BE742185FA870CCCCB7ABEBE96E596880417CF7F27B5EFF35CB2B16A5ADDC11BA1D0B9E3324B5ED
Malicious:	false
Preview:	Build: dilda..Version: 1.9....Date: Fri May 3 07:23:28 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 870554ee6dfe065d5ee5bde314dc5f7f....Path: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixydBSgyOXmoj0v....IP: 191.96.227.219..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 936905 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 3/5/2024 7:23:28..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776].

C:\Users\user\AppData\Local\Temp\trixydBSgyOXmoj0v\passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469436287152591
Encrypted:	false
SSDEEP:	6144:pIXfpi67eLPU9skLmb0b41WSPKaJG8nAgejZMMhA2gX4WABl0uNWdwBCswSbw:aXD941WlLZMM6YFHw+w
MD5:	87494BF8A007D2856BEF1DA3AFB00878
SHA1:	CE0BC0724DD1F440FB9BE1F701A598FC21E6731B
SHA-256:	453D0827223018FE84E2D67709D39A435FD6E485A260728F4583B8762D2338DB
SHA-512:	D53F0F81A323ADF7E468AC341533BB1AAD6A21F5DB75F71AFA0B10BA7B44D0B92B10A3615E86F71125BC4956619ECDA051CB4CC2C3789823B2D91311017E12E7
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....................................................................................................................................................................................................................................................................................................................................................N.6........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.973137564039597
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
File size:	3'197'440 bytes
MD5:	8d6e0fa54df379d380222a4051ab848c
SHA1:	aaf9a4b13c41beb62d8b40440a37e999c512a33a
SHA256:	bc85f6c9d136388898852a62309eef10a34b3118fd024281e14e468594c2ff9f
SHA512:	650cdc9ce136f8dd3a324a92571be5309c86e25ed40c463fe2ff6161723eb056d50fcb3dc0f5f1941316ce9f411eea5c67988ebf3b0b3037477e94af7a7119a6
SSDEEP:	49152:vXXEVscFrenB6teP9akEurndc2IWBvXBcu2C3EOeZFvb0mLnAycFXd/En/8SdE7h:vnEicenY8sburUW5Xb2CM3k1BakSi7k
TLSH:	7CE533E2B9378B41D5602A730D2ED27CDA49CDD99B18603365D6BD07BC3E94AAC14E0F
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	4c4d96ec0ce6c600

Static PE Info

General

Entrypoint:	0xf5c3b4
Entrypoint Section:	.data
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x663202DB [Wed May 1 08:52:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	272279f18f704f637aa129691266b291

Entrypoint Preview

Instruction
jmp 00007FB83086E1EAh
add byte ptr [eax+0Eh], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax-18h], ah
add byte ptr [eax], al
add byte ptr [eax], al
pop ebp
sub ebp, 00000010h
sub ebp, 00B5C3B4h
jmp 00007FB83086E1E9h
fisttp qword ptr [eax+ebx-3C4B4719h]
mov ch, 00h
add eax, ebp
add eax, 0000004Ch
mov ecx, 000005AAh
mov edx, DB06F5B3h
xor byte ptr [eax], dl
inc eax
dec ecx
jne 00007FB83086E1DCh
jmp 00007FB83086E1E9h
in eax, 8Bh
mov esi, 387E3830h
cmp cl, byte ptr [edi+32B3B3B3h]
jc 00007FB83086E22Dh
mov bl, B3h
mov bl, B0h
jle 00007FB83086E1EDh
mov ch, B3h
mov bl, B3h
or dword ptr [ebx+44B3B3B3h], ebx
push ecx
mov al, 7Bh
cmp byte ptr [edx], dh
mov edi, B0B3B3B3h
jbe 00007FB83086E220h
xlatb
xchg eax, edi
dec edi
cmp dh, byte ptr [edi+77DBE397h]
cmp al, 92h
mov bl, DBh
pop ebp
and byte ptr [edi], FFFFFFB3h
mov dl, 9Fh
xchg eax, edi
fcmovnb st(0), st(7)
xchg dword ptr [eax-4C49A4B0h], ebp
mov bl, B3h
pop edx
wait
mov bl, B3h
mov bl, E6h
out EEh, eax
cmp byte ptr [esi], dh
mov ebx, 38B3B3B3h
mov edi, 38B3B3B3h
mov dword ptr [72B3B3B3h], eax
pop edx
mov cl, 82h
mov cl, 30h
jno 00007FB83086E199h
cli
mov esp, 4C4C4736h
dec esp
out dx, al
jno 00007FB83086E1A1h
mov bl, 38h
aas
xchg eax, edi
mov bh, B3h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x93b050	0xe1a	.data
IMAGE_DIRECTORY_ENTRY_IMPORT	0x93be6c	0x3b0	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19c000	0xafa0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x93b030	0x10	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x93b000	0x18	.data
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x159000	0x92a00	c7dfc887323f1dc1927fe5930a5cb4f2	False	0.9997618952472294	data	7.999628050473961	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x15a000	0x28000	0x10200	22fcfa38c7aa06a109b013fd544976a2	False	0.9934290213178295	data	7.991031678374504	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x182000	0x5000	0x800	ddf4d511939204e83114387be16ec4ca	False	0.99462890625	data	7.818155657101209	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x187000	0xb000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x192000	0xa000	0x6000	681616b89d5c5df45d240c0af1f8dfd1	False	1.0006510416666667	data	7.990686327893471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19c000	0xb000	0xb000	f55c5215c73a04b580fdee8f27a08ae5	False	0.11330344460227272	data	2.153423809128472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x1a7000	0x791000	0x32800	651c2ff301dd0f5de99da99e6a34d888	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x938000	0x226000	0x225a00	a78308dd676d0938f41a88312865aae6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19c250	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Russian	Russia	0.1320921985815603
RT_ICON	0x19c6b8	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1600	Russian	Russia	0.10465116279069768
RT_ICON	0x19cd70	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Russian	Russia	0.08770491803278689
RT_ICON	0x19d6f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Russian	Russia	0.05722326454033771
RT_ICON	0x19e7a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Russian	Russia	0.03475103734439834
RT_ICON	0x1a0d48	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	Russian	Russia	0.02509447331128956
RT_ICON	0x1a4f70	0x1aae	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.39780380673499266
RT_GROUP_ICON	0x1a6a20	0x68	data	Russian	Russia	0.7596153846153846
RT_VERSION	0x1a6a88	0x398	OpenPGP Public Key	Russian	Russia	0.42282608695652174
RT_MANIFEST	0x1a6e20	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
ole32.dll	CoInitialize
WS2_32.dll	WSAStartup
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders
SETUPAPI.dll	SetupDiEnumDeviceInfo
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/03/24-07:23:28.105870	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49763	58709	192.168.2.4	147.45.47.93
05/03/24-07:22:59.725168	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49730	147.45.47.93	192.168.2.4
05/03/24-07:22:56.225615	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49730	147.45.47.93	192.168.2.4
05/03/24-07:22:59.405493	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49730	58709	192.168.2.4	147.45.47.93
05/03/24-07:23:15.979133	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49745	58709	192.168.2.4	147.45.47.93
05/03/24-07:23:24.180700	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49763	147.45.47.93	192.168.2.4
05/03/24-07:23:42.768589	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49763	147.45.47.93	192.168.2.4
05/03/24-07:23:27.210544	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49760	58709	192.168.2.4	147.45.47.93
05/03/24-07:23:16.615218	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49760	147.45.47.93	192.168.2.4
05/03/24-07:23:19.547675	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49760	147.45.47.93	192.168.2.4
05/03/24-07:22:56.058203	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49730	58709	192.168.2.4	147.45.47.93
05/03/24-07:23:16.143178	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49744	58709	192.168.2.4	147.45.47.93
05/03/24-07:23:05.888918	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49745	147.45.47.93	192.168.2.4
05/03/24-07:23:05.759701	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49744	147.45.47.93	192.168.2.4
05/03/24-07:23:08.989573	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49744	147.45.47.93	192.168.2.4
05/03/24-07:23:09.005119	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49745	147.45.47.93	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 3, 2024 07:22:47.642311096 CEST	49678	443	192.168.2.4	104.46.162.224
May 3, 2024 07:22:48.126650095 CEST	49675	443	192.168.2.4	173.222.162.32
May 3, 2024 07:22:55.846683025 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:22:56.037043095 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:22:56.037132025 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:22:56.058202982 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:22:56.225615025 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:22:56.282919884 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:22:56.291929007 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:22:59.405493021 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:22:59.636431932 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:22:59.725167990 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:22:59.814344883 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:22:59.957137108 CEST	49734	443	192.168.2.4	34.117.186.192
May 3, 2024 07:22:59.957178116 CEST	443	49734	34.117.186.192	192.168.2.4
May 3, 2024 07:22:59.958307028 CEST	49734	443	192.168.2.4	34.117.186.192
May 3, 2024 07:22:59.963486910 CEST	49734	443	192.168.2.4	34.117.186.192
May 3, 2024 07:22:59.963504076 CEST	443	49734	34.117.186.192	192.168.2.4
May 3, 2024 07:23:00.222131968 CEST	443	49734	34.117.186.192	192.168.2.4
May 3, 2024 07:23:00.222228050 CEST	49734	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:01.291457891 CEST	49734	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:01.291480064 CEST	443	49734	34.117.186.192	192.168.2.4
May 3, 2024 07:23:01.291740894 CEST	443	49734	34.117.186.192	192.168.2.4
May 3, 2024 07:23:01.419364929 CEST	49734	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:01.460120916 CEST	443	49734	34.117.186.192	192.168.2.4
May 3, 2024 07:23:01.560146093 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:01.565792084 CEST	443	49734	34.117.186.192	192.168.2.4
May 3, 2024 07:23:01.566065073 CEST	443	49734	34.117.186.192	192.168.2.4
May 3, 2024 07:23:01.566108942 CEST	49734	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:01.606765032 CEST	49734	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:01.606786966 CEST	443	49734	34.117.186.192	192.168.2.4
May 3, 2024 07:23:01.606807947 CEST	49734	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:01.606815100 CEST	443	49734	34.117.186.192	192.168.2.4
May 3, 2024 07:23:01.719520092 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:02.016576052 CEST	49737	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:02.016601086 CEST	443	49737	104.26.5.15	192.168.2.4
May 3, 2024 07:23:02.016663074 CEST	49737	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:02.017154932 CEST	49737	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:02.017165899 CEST	443	49737	104.26.5.15	192.168.2.4
May 3, 2024 07:23:02.204715967 CEST	443	49737	104.26.5.15	192.168.2.4
May 3, 2024 07:23:02.204801083 CEST	49737	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:02.208465099 CEST	49737	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:02.208468914 CEST	443	49737	104.26.5.15	192.168.2.4
May 3, 2024 07:23:02.208673954 CEST	443	49737	104.26.5.15	192.168.2.4
May 3, 2024 07:23:02.210028887 CEST	49737	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:02.252121925 CEST	443	49737	104.26.5.15	192.168.2.4
May 3, 2024 07:23:02.519364119 CEST	443	49737	104.26.5.15	192.168.2.4
May 3, 2024 07:23:02.519427061 CEST	443	49737	104.26.5.15	192.168.2.4
May 3, 2024 07:23:02.519499063 CEST	49737	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:02.519936085 CEST	49737	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:02.519943953 CEST	443	49737	104.26.5.15	192.168.2.4
May 3, 2024 07:23:02.519969940 CEST	49737	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:02.519974947 CEST	443	49737	104.26.5.15	192.168.2.4
May 3, 2024 07:23:02.520390987 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:02.577033997 CEST	49738	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.577058077 CEST	443	49738	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.577119112 CEST	49738	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.577327967 CEST	49738	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.577339888 CEST	443	49738	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.608772039 CEST	49739	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.608793020 CEST	443	49739	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.608854055 CEST	49739	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.609102011 CEST	49739	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.609112978 CEST	443	49739	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.697345018 CEST	49740	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.697379112 CEST	443	49740	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.697626114 CEST	49740	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.697892904 CEST	49740	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.697911024 CEST	443	49740	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.760811090 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:02.766319036 CEST	443	49738	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.767184019 CEST	49738	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.767196894 CEST	443	49738	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.768222094 CEST	443	49738	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.768281937 CEST	49738	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.775315046 CEST	49738	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.775374889 CEST	443	49738	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.775563002 CEST	49738	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.775568962 CEST	443	49738	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.794363976 CEST	443	49739	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.794641018 CEST	49739	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.794653893 CEST	443	49739	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.795511961 CEST	443	49739	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.795572996 CEST	49739	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.795856953 CEST	49739	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.795907974 CEST	443	49739	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.795985937 CEST	49739	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.795991898 CEST	443	49739	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.829845905 CEST	49738	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.882143021 CEST	443	49740	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.889681101 CEST	49740	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.889699936 CEST	443	49740	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.890553951 CEST	443	49740	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.890746117 CEST	49740	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.890994072 CEST	49740	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.891052961 CEST	443	49740	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.891105890 CEST	49740	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.923362017 CEST	49739	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.936129093 CEST	443	49740	142.250.72.100	192.168.2.4
May 3, 2024 07:23:02.997226954 CEST	49740	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:02.997239113 CEST	443	49740	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.129992962 CEST	49740	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.370009899 CEST	443	49739	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.370124102 CEST	443	49739	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.370418072 CEST	49739	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.371017933 CEST	49739	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.371033907 CEST	443	49739	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.372483969 CEST	49741	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.372524977 CEST	443	49741	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.372756958 CEST	49741	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.373020887 CEST	49741	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.373034954 CEST	443	49741	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.376820087 CEST	443	49740	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.376923084 CEST	443	49740	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.377006054 CEST	49740	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.377615929 CEST	49740	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.377633095 CEST	443	49740	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.379728079 CEST	49742	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.379757881 CEST	443	49742	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.379812002 CEST	49742	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.380047083 CEST	49742	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.380062103 CEST	443	49742	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.404033899 CEST	443	49738	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.404139042 CEST	443	49738	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.404294968 CEST	49738	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.404807091 CEST	49738	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.404817104 CEST	443	49738	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.406325102 CEST	49743	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.406353951 CEST	443	49743	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.406464100 CEST	49743	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.406883001 CEST	49743	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.406898975 CEST	443	49743	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.516591072 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:03.556811094 CEST	443	49741	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.560367107 CEST	49741	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.560399055 CEST	443	49741	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.560686111 CEST	443	49741	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.561100960 CEST	49741	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.561156034 CEST	443	49741	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.561407089 CEST	49741	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.564721107 CEST	443	49742	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.564929008 CEST	49742	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.564955950 CEST	443	49742	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.565288067 CEST	443	49742	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.565800905 CEST	49742	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.565865040 CEST	443	49742	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.565937996 CEST	49742	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.590305090 CEST	443	49743	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.590723038 CEST	49743	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.590743065 CEST	443	49743	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.591605902 CEST	443	49743	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.591665983 CEST	49743	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.591964006 CEST	49743	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.592016935 CEST	443	49743	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.592114925 CEST	49743	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.608125925 CEST	443	49741	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.608125925 CEST	443	49742	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.610953093 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:03.610980034 CEST	49742	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.626760006 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:03.640109062 CEST	443	49743	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.720304966 CEST	49743	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.720324039 CEST	443	49743	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.745608091 CEST	443	49741	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.745651007 CEST	443	49741	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.745692968 CEST	443	49741	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.745726109 CEST	49741	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.745744944 CEST	443	49741	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.745755911 CEST	443	49741	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.745786905 CEST	49741	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.745820045 CEST	49741	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.748898983 CEST	49741	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.748913050 CEST	443	49741	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.752469063 CEST	443	49742	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.752509117 CEST	443	49742	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.752556086 CEST	443	49742	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.752559900 CEST	49742	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.752583027 CEST	443	49742	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.752619028 CEST	443	49742	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.752660990 CEST	49742	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.753756046 CEST	49742	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.753767014 CEST	443	49742	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.781949997 CEST	443	49743	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.781985998 CEST	443	49743	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.782011032 CEST	49743	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.782027960 CEST	443	49743	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.782035112 CEST	443	49743	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.782080889 CEST	49743	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.787369013 CEST	49743	443	192.168.2.4	142.250.72.100
May 3, 2024 07:23:03.787385941 CEST	443	49743	142.250.72.100	192.168.2.4
May 3, 2024 07:23:03.872612953 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:05.382714033 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:05.508996964 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:05.571119070 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:05.571187019 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:05.586539030 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:05.697490931 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:05.697566032 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:05.731311083 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:05.759701014 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:05.823518991 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:05.888917923 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:05.912058115 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:05.966959953 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:05.984885931 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:07.718096018 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:07.772516966 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:07.782588005 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:08.026557922 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.267051935 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.267162085 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.267225027 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:08.267261028 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.267335892 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.267385006 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:08.267436028 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.267514944 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.267555952 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:08.267579079 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.267666101 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.267710924 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:08.267716885 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.267776966 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.267813921 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:08.455987930 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.456005096 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.456016064 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.456027985 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.456056118 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.456064939 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:08.456067085 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:08.456124067 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:08.989573002 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:09.005119085 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:09.032193899 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:09.047813892 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:09.120362043 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:09.172808886 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:09.221055984 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:09.236277103 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:09.360332966 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:09.456736088 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:10.327341080 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:10.514358997 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:10.542110920 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:10.542202950 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:10.745482922 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:10.776784897 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:11.298003912 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:11.298088074 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:11.337073088 CEST	49748	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.337097883 CEST	443	49748	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.337158918 CEST	49748	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.338479996 CEST	49748	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.338491917 CEST	443	49748	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.338578939 CEST	49749	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.338609934 CEST	443	49749	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.338664055 CEST	49749	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.339876890 CEST	49749	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.339889050 CEST	443	49749	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.542133093 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:11.542301893 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:11.593586922 CEST	443	49748	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.593693972 CEST	49748	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.594712019 CEST	443	49749	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.594775915 CEST	49749	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.606847048 CEST	49748	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.606857061 CEST	443	49748	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.607053041 CEST	443	49748	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.617707014 CEST	49749	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.617723942 CEST	443	49749	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.617935896 CEST	443	49749	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.699451923 CEST	49748	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.709620953 CEST	49749	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.714590073 CEST	49750	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:11.714621067 CEST	443	49750	23.51.58.94	192.168.2.4
May 3, 2024 07:23:11.714693069 CEST	49750	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:11.716459990 CEST	49750	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:11.716475964 CEST	443	49750	23.51.58.94	192.168.2.4
May 3, 2024 07:23:11.744113922 CEST	443	49748	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.752121925 CEST	443	49749	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.856792927 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:11.856822014 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:11.856910944 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:11.857990980 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:11.858007908 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:11.871258974 CEST	443	49748	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.871447086 CEST	443	49748	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.871510029 CEST	49748	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.871660948 CEST	49748	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.871669054 CEST	443	49748	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.871706009 CEST	49748	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.871711016 CEST	443	49748	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.873120070 CEST	49752	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:11.873141050 CEST	443	49752	104.26.5.15	192.168.2.4
May 3, 2024 07:23:11.873199940 CEST	49752	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:11.873472929 CEST	49752	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:11.873486042 CEST	443	49752	104.26.5.15	192.168.2.4
May 3, 2024 07:23:11.875094891 CEST	443	49749	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.875212908 CEST	443	49749	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.875283957 CEST	49749	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.875453949 CEST	49749	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.875468016 CEST	443	49749	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.875478029 CEST	49749	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:11.875482082 CEST	443	49749	34.117.186.192	192.168.2.4
May 3, 2024 07:23:11.876866102 CEST	49753	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:11.876913071 CEST	443	49753	104.26.5.15	192.168.2.4
May 3, 2024 07:23:11.876981974 CEST	49753	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:11.877378941 CEST	49753	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:11.877397060 CEST	443	49753	104.26.5.15	192.168.2.4
May 3, 2024 07:23:11.903794050 CEST	443	49750	23.51.58.94	192.168.2.4
May 3, 2024 07:23:11.903882980 CEST	49750	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:11.905428886 CEST	49750	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:11.905436039 CEST	443	49750	23.51.58.94	192.168.2.4
May 3, 2024 07:23:11.905638933 CEST	443	49750	23.51.58.94	192.168.2.4
May 3, 2024 07:23:11.944832087 CEST	49750	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:11.988133907 CEST	443	49750	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.060595036 CEST	443	49752	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.060745001 CEST	49752	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:12.061805010 CEST	49752	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:12.061815023 CEST	443	49752	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.061857939 CEST	443	49753	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.061918974 CEST	49753	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:12.062043905 CEST	443	49752	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.062783003 CEST	49753	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:12.062793016 CEST	443	49753	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.063019037 CEST	443	49753	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.063849926 CEST	49752	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:12.064826012 CEST	49753	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:12.080077887 CEST	443	49750	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.080287933 CEST	49750	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:12.080306053 CEST	443	49750	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.080326080 CEST	49750	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:12.080420971 CEST	443	49750	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.080451012 CEST	443	49750	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.080501080 CEST	49750	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:12.104119062 CEST	443	49752	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.112107038 CEST	443	49753	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.116609097 CEST	49754	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:12.116638899 CEST	443	49754	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.116803885 CEST	49754	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:12.117019892 CEST	49754	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:12.117032051 CEST	443	49754	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.261225939 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.261317015 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:12.263030052 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:12.263042927 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.263252974 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.298180103 CEST	443	49754	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.298249960 CEST	49754	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:12.299696922 CEST	49754	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:12.299702883 CEST	443	49754	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.299896002 CEST	443	49754	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.301059961 CEST	49754	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:12.348119020 CEST	443	49754	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.374270916 CEST	443	49752	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.374341011 CEST	443	49752	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.374383926 CEST	49752	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:12.374691963 CEST	49752	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:12.374691963 CEST	49752	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:12.374712944 CEST	443	49752	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.374732971 CEST	443	49752	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.375241995 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:12.375633001 CEST	443	49753	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.375710964 CEST	443	49753	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.375749111 CEST	49753	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:12.375957012 CEST	49753	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:12.375972986 CEST	443	49753	104.26.5.15	192.168.2.4
May 3, 2024 07:23:12.376512051 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:12.445234060 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:12.476159096 CEST	443	49754	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.508001089 CEST	443	49754	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.508089066 CEST	49754	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:12.509255886 CEST	49754	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:12.509268999 CEST	443	49754	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.509322882 CEST	49754	443	192.168.2.4	23.51.58.94
May 3, 2024 07:23:12.509327888 CEST	443	49754	23.51.58.94	192.168.2.4
May 3, 2024 07:23:12.604898930 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:12.612004995 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:12.620439053 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:12.635014057 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:12.656120062 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.750061989 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:12.751589060 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:12.817655087 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:12.842957973 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:12.873025894 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.873044968 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.873051882 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.873083115 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.873095036 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.873100996 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.873127937 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:12.873145103 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.873167038 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:12.873188972 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.873198986 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.873203039 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:12.873217106 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.873224974 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.873235941 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:12.873254061 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:12.873275995 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:12.873315096 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:12.923841953 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:13.031199932 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:13.033777952 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:13.151608944 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:13.276355982 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:15.134536982 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:15.134562016 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:15.134572983 CEST	49751	443	192.168.2.4	52.165.165.26
May 3, 2024 07:23:15.134579897 CEST	443	49751	52.165.165.26	192.168.2.4
May 3, 2024 07:23:15.979132891 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:16.143177986 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:16.214359999 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:16.237636089 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:16.385654926 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:16.426348925 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:16.426457882 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:16.448417902 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:16.503865004 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:16.503958941 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:16.615217924 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:16.682540894 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:16.692424059 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:16.692476034 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:16.692620993 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:16.753647089 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:16.932620049 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:18.956321955 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:18.956450939 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:18.956537008 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:18.956598997 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:18.956617117 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:18.956690073 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:18.956789970 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:18.956805944 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:18.956820965 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:18.956856966 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:18.956944942 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:18.956990004 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:18.957016945 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:18.957035065 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:18.957076073 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:18.969280005 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:18.969867945 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:19.145087957 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:19.145145893 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:19.145190954 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:19.145241022 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:19.145328999 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:19.145366907 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:19.145400047 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:19.145441055 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:19.145476103 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:19.214302063 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:19.220161915 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:19.293267965 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:19.335381031 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:19.344608068 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:19.454308033 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:19.463946104 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:19.547674894 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:19.566957951 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:19.637298107 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:19.755537033 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:19.775041103 CEST	49761	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:19.775072098 CEST	443	49761	34.117.186.192	192.168.2.4
May 3, 2024 07:23:19.775135040 CEST	49761	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:19.776575089 CEST	49761	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:19.776591063 CEST	443	49761	34.117.186.192	192.168.2.4
May 3, 2024 07:23:20.032027960 CEST	443	49761	34.117.186.192	192.168.2.4
May 3, 2024 07:23:20.032121897 CEST	49761	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:20.047326088 CEST	49761	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:20.047338009 CEST	443	49761	34.117.186.192	192.168.2.4
May 3, 2024 07:23:20.047540903 CEST	443	49761	34.117.186.192	192.168.2.4
May 3, 2024 07:23:20.126204014 CEST	49761	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:20.168126106 CEST	443	49761	34.117.186.192	192.168.2.4
May 3, 2024 07:23:20.307009935 CEST	443	49761	34.117.186.192	192.168.2.4
May 3, 2024 07:23:20.307121038 CEST	443	49761	34.117.186.192	192.168.2.4
May 3, 2024 07:23:20.307169914 CEST	49761	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:20.307614088 CEST	49761	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:20.307630062 CEST	443	49761	34.117.186.192	192.168.2.4
May 3, 2024 07:23:20.307645082 CEST	49761	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:20.307651043 CEST	443	49761	34.117.186.192	192.168.2.4
May 3, 2024 07:23:20.309153080 CEST	49762	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:20.309179068 CEST	443	49762	104.26.5.15	192.168.2.4
May 3, 2024 07:23:20.309241056 CEST	49762	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:20.309628963 CEST	49762	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:20.309644938 CEST	443	49762	104.26.5.15	192.168.2.4
May 3, 2024 07:23:20.491189957 CEST	443	49762	104.26.5.15	192.168.2.4
May 3, 2024 07:23:20.491275072 CEST	49762	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:20.492856979 CEST	49762	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:20.492871046 CEST	443	49762	104.26.5.15	192.168.2.4
May 3, 2024 07:23:20.493071079 CEST	443	49762	104.26.5.15	192.168.2.4
May 3, 2024 07:23:20.495013952 CEST	49762	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:20.540112019 CEST	443	49762	104.26.5.15	192.168.2.4
May 3, 2024 07:23:20.655936003 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.657627106 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.677407980 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.677717924 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.677733898 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.677752018 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.677769899 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.677798986 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.677846909 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.678000927 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.678016901 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.678030968 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.678044081 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.678047895 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.678065062 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.678075075 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.678102970 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.737710953 CEST	443	49762	104.26.5.15	192.168.2.4
May 3, 2024 07:23:20.737782001 CEST	443	49762	104.26.5.15	192.168.2.4
May 3, 2024 07:23:20.737835884 CEST	49762	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:20.738416910 CEST	49762	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:20.738429070 CEST	443	49762	104.26.5.15	192.168.2.4
May 3, 2024 07:23:20.738447905 CEST	49762	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:20.738452911 CEST	443	49762	104.26.5.15	192.168.2.4
May 3, 2024 07:23:20.739061117 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.810075998 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.859497070 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.866271973 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.866348982 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.866411924 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.866414070 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.866501093 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.866565943 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.866578102 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.866605043 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.866632938 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.880642891 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.933026075 CEST	58709	49730	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.933083057 CEST	49730	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.956110954 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.956110954 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:20.980701923 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:20.980813980 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:21.077749968 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.105492115 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:21.144439936 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.213887930 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.215930939 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:21.312238932 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.409904957 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:21.448421001 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.556242943 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.635863066 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:21.860960007 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.860982895 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.860996008 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.861007929 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.861020088 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.861032009 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.861105919 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:21.861160040 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:21.861407042 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.861424923 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.861437082 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.861454964 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:21.861466885 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:21.861529112 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:22.050529957 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:22.050549030 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:22.050610065 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:22.050640106 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:22.050707102 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:22.050748110 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:22.050800085 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:22.050826073 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:22.050945997 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:23.073362112 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:23.282022953 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:23.367535114 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:23.562827110 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:23.644148111 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:23.803674936 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:23.992132902 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:23.992203951 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:24.036168098 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:24.180700064 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:24.276482105 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:24.351938963 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:25.274581909 CEST	49764	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:25.274616003 CEST	443	49764	40.126.24.82	192.168.2.4
May 3, 2024 07:23:25.274677992 CEST	49764	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:25.289361954 CEST	49764	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:25.289378881 CEST	443	49764	40.126.24.82	192.168.2.4
May 3, 2024 07:23:25.595165968 CEST	443	49764	40.126.24.82	192.168.2.4
May 3, 2024 07:23:25.595248938 CEST	49764	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:25.630496025 CEST	49764	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:25.630513906 CEST	443	49764	40.126.24.82	192.168.2.4
May 3, 2024 07:23:25.630701065 CEST	443	49764	40.126.24.82	192.168.2.4
May 3, 2024 07:23:25.632169962 CEST	49764	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:25.632194996 CEST	49764	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:25.632231951 CEST	443	49764	40.126.24.82	192.168.2.4
May 3, 2024 07:23:26.073733091 CEST	443	49764	40.126.24.82	192.168.2.4
May 3, 2024 07:23:26.073805094 CEST	443	49764	40.126.24.82	192.168.2.4
May 3, 2024 07:23:26.078510046 CEST	49764	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:27.210544109 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:27.448957920 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:28.105870008 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:28.338855982 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:28.567133904 CEST	49764	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:28.567133904 CEST	49764	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:28.567173004 CEST	443	49764	40.126.24.82	192.168.2.4
May 3, 2024 07:23:28.567183971 CEST	443	49764	40.126.24.82	192.168.2.4
May 3, 2024 07:23:28.673420906 CEST	49765	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:28.673454046 CEST	443	49765	40.126.24.82	192.168.2.4
May 3, 2024 07:23:28.673532963 CEST	49765	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:28.674710035 CEST	49765	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:28.674731970 CEST	443	49765	40.126.24.82	192.168.2.4
May 3, 2024 07:23:28.979863882 CEST	443	49765	40.126.24.82	192.168.2.4
May 3, 2024 07:23:28.988982916 CEST	49765	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:28.989017963 CEST	443	49765	40.126.24.82	192.168.2.4
May 3, 2024 07:23:28.989727974 CEST	49765	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:28.989732981 CEST	443	49765	40.126.24.82	192.168.2.4
May 3, 2024 07:23:28.989769936 CEST	49765	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:28.989779949 CEST	443	49765	40.126.24.82	192.168.2.4
May 3, 2024 07:23:28.991728067 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:28.991784096 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:28.997143030 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:28.997410059 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:29.162081957 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:29.162143946 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:29.180583000 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:29.180656910 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:29.185823917 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:29.185857058 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:29.185869932 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:29.186103106 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:29.351774931 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:29.351789951 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:29.351805925 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:29.351828098 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:29.417165995 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:29.417227983 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:29.589386940 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:31.321520090 CEST	443	49765	40.126.24.82	192.168.2.4
May 3, 2024 07:23:31.321543932 CEST	443	49765	40.126.24.82	192.168.2.4
May 3, 2024 07:23:31.321562052 CEST	443	49765	40.126.24.82	192.168.2.4
May 3, 2024 07:23:31.321621895 CEST	49765	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:31.321643114 CEST	443	49765	40.126.24.82	192.168.2.4
May 3, 2024 07:23:31.321656942 CEST	49765	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:31.321676016 CEST	443	49765	40.126.24.82	192.168.2.4
May 3, 2024 07:23:31.321693897 CEST	49765	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:31.321732998 CEST	49765	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:31.322208881 CEST	49765	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:31.322225094 CEST	443	49765	40.126.24.82	192.168.2.4
May 3, 2024 07:23:31.322238922 CEST	49765	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:31.322244883 CEST	443	49765	40.126.24.82	192.168.2.4
May 3, 2024 07:23:31.375407934 CEST	49766	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:31.375432014 CEST	443	49766	40.126.24.82	192.168.2.4
May 3, 2024 07:23:31.375500917 CEST	49766	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:31.375660896 CEST	49766	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:31.375675917 CEST	443	49766	40.126.24.82	192.168.2.4
May 3, 2024 07:23:31.678248882 CEST	443	49766	40.126.24.82	192.168.2.4
May 3, 2024 07:23:31.678747892 CEST	49766	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:31.678772926 CEST	443	49766	40.126.24.82	192.168.2.4
May 3, 2024 07:23:31.679403067 CEST	49766	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:31.679409981 CEST	443	49766	40.126.24.82	192.168.2.4
May 3, 2024 07:23:31.679435968 CEST	49766	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:31.679445028 CEST	443	49766	40.126.24.82	192.168.2.4
May 3, 2024 07:23:32.110707998 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:32.126375914 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:32.282459021 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:32.299253941 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:32.314920902 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:32.474096060 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:34.953329086 CEST	443	49766	40.126.24.82	192.168.2.4
May 3, 2024 07:23:34.953355074 CEST	443	49766	40.126.24.82	192.168.2.4
May 3, 2024 07:23:34.953387022 CEST	443	49766	40.126.24.82	192.168.2.4
May 3, 2024 07:23:34.953442097 CEST	49766	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:34.953444004 CEST	443	49766	40.126.24.82	192.168.2.4
May 3, 2024 07:23:34.953476906 CEST	49766	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:34.953510046 CEST	49766	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:34.953915119 CEST	49766	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:34.953915119 CEST	49766	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:34.953933001 CEST	443	49766	40.126.24.82	192.168.2.4
May 3, 2024 07:23:34.953942060 CEST	443	49766	40.126.24.82	192.168.2.4
May 3, 2024 07:23:34.988037109 CEST	49767	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:34.988091946 CEST	443	49767	40.126.24.82	192.168.2.4
May 3, 2024 07:23:34.988220930 CEST	49767	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:34.988419056 CEST	49767	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:34.988435984 CEST	443	49767	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.290981054 CEST	443	49767	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.291627884 CEST	49767	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.291650057 CEST	443	49767	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.292346001 CEST	49767	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.292351007 CEST	443	49767	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.292388916 CEST	49767	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.292397976 CEST	443	49767	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.519156933 CEST	443	49767	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.519171000 CEST	443	49767	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.519218922 CEST	443	49767	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.519247055 CEST	49767	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.519279957 CEST	49767	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.519453049 CEST	49767	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.519471884 CEST	443	49767	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.519480944 CEST	49767	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.519485950 CEST	443	49767	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.543772936 CEST	49768	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.543800116 CEST	443	49768	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.544089079 CEST	49768	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.544337034 CEST	49768	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.544349909 CEST	443	49768	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.547200918 CEST	49769	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.547251940 CEST	443	49769	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.547816992 CEST	49769	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.548525095 CEST	49769	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.548541069 CEST	443	49769	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.844993114 CEST	443	49768	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.845822096 CEST	49768	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.845841885 CEST	443	49768	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.846522093 CEST	49768	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.846527100 CEST	443	49768	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.846587896 CEST	49768	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.846596956 CEST	443	49768	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.848848104 CEST	443	49769	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.849315882 CEST	49769	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.849340916 CEST	443	49769	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.849950075 CEST	49769	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.849956036 CEST	443	49769	40.126.24.82	192.168.2.4
May 3, 2024 07:23:35.849975109 CEST	49769	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:35.849983931 CEST	443	49769	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.060715914 CEST	443	49768	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.060730934 CEST	443	49768	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.060784101 CEST	443	49768	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.060904026 CEST	49768	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:36.061281919 CEST	49768	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:36.061294079 CEST	443	49768	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.061304092 CEST	49768	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:36.061309099 CEST	443	49768	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.510196924 CEST	443	49769	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.510216951 CEST	443	49769	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.510260105 CEST	443	49769	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.510274887 CEST	443	49769	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.510317087 CEST	49769	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:36.510365009 CEST	49769	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:36.510582924 CEST	49769	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:36.510601044 CEST	443	49769	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.510611057 CEST	49769	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:36.510617018 CEST	443	49769	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.533339024 CEST	49770	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:36.533412933 CEST	443	49770	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.533663988 CEST	49770	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:36.533828974 CEST	49770	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:36.533855915 CEST	443	49770	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.835339069 CEST	443	49770	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.835890055 CEST	49770	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:36.835937977 CEST	443	49770	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.836538076 CEST	49770	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:36.836550951 CEST	443	49770	40.126.24.82	192.168.2.4
May 3, 2024 07:23:36.836616993 CEST	49770	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:36.836632967 CEST	443	49770	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.105089903 CEST	443	49770	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.105108023 CEST	443	49770	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.105142117 CEST	443	49770	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.105185986 CEST	443	49770	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.105225086 CEST	49770	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.105272055 CEST	49770	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.107284069 CEST	49770	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.107321978 CEST	443	49770	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.107351065 CEST	49770	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.107366085 CEST	443	49770	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.127425909 CEST	49771	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.127454996 CEST	443	49771	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.127569914 CEST	49771	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.127706051 CEST	49771	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.127716064 CEST	443	49771	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.428829908 CEST	443	49771	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.429383039 CEST	49771	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.429403067 CEST	443	49771	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.430258036 CEST	49771	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.430263042 CEST	443	49771	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.430322886 CEST	49771	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.430330992 CEST	443	49771	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.691224098 CEST	443	49771	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.691246033 CEST	443	49771	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.691291094 CEST	443	49771	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.691318035 CEST	49771	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.691334009 CEST	443	49771	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.691345930 CEST	443	49771	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.691364050 CEST	49771	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.691390991 CEST	49771	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.691673994 CEST	49771	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.691688061 CEST	443	49771	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.691695929 CEST	49771	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.691700935 CEST	443	49771	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.716448069 CEST	49773	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.716542006 CEST	443	49773	40.126.24.82	192.168.2.4
May 3, 2024 07:23:37.716814041 CEST	49773	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.716886997 CEST	49773	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:37.716898918 CEST	443	49773	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.016590118 CEST	443	49773	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.017142057 CEST	49773	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.017168999 CEST	443	49773	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.017884970 CEST	49773	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.017885923 CEST	49773	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.017894030 CEST	443	49773	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.017910957 CEST	443	49773	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.327105999 CEST	443	49773	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.327125072 CEST	443	49773	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.327166080 CEST	443	49773	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.327208996 CEST	443	49773	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.327219009 CEST	49773	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.327260017 CEST	49773	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.327281952 CEST	49773	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.327580929 CEST	49773	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.327600956 CEST	443	49773	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.327610970 CEST	49773	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.327616930 CEST	443	49773	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.353590012 CEST	49775	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.353635073 CEST	443	49775	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.354049921 CEST	49775	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.354192019 CEST	49775	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.354207039 CEST	443	49775	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.655884027 CEST	443	49775	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.655951977 CEST	49775	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.658437967 CEST	49775	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.658448935 CEST	443	49775	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.658652067 CEST	443	49775	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.659024954 CEST	49775	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.659053087 CEST	49775	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.659084082 CEST	443	49775	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.886418104 CEST	443	49775	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.886436939 CEST	443	49775	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.886492968 CEST	49775	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.886493921 CEST	443	49775	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.886528015 CEST	443	49775	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.886558056 CEST	49775	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.886578083 CEST	443	49775	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.886703014 CEST	49775	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.886889935 CEST	49775	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.886909008 CEST	443	49775	40.126.24.82	192.168.2.4
May 3, 2024 07:23:38.886919022 CEST	49775	443	192.168.2.4	40.126.24.82
May 3, 2024 07:23:38.886924982 CEST	443	49775	40.126.24.82	192.168.2.4
May 3, 2024 07:23:42.325088024 CEST	58709	49760	147.45.47.93	192.168.2.4
May 3, 2024 07:23:42.325170040 CEST	49760	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:42.534298897 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:42.579102039 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:42.768589020 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:42.809210062 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:42.857285976 CEST	49779	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:42.857341051 CEST	443	49779	34.117.186.192	192.168.2.4
May 3, 2024 07:23:42.857536077 CEST	49779	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:42.858800888 CEST	49779	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:42.858814001 CEST	443	49779	34.117.186.192	192.168.2.4
May 3, 2024 07:23:42.997447968 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:43.050304890 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:43.114233971 CEST	443	49779	34.117.186.192	192.168.2.4
May 3, 2024 07:23:43.114326000 CEST	49779	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:43.115940094 CEST	49779	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:43.115948915 CEST	443	49779	34.117.186.192	192.168.2.4
May 3, 2024 07:23:43.116188049 CEST	443	49779	34.117.186.192	192.168.2.4
May 3, 2024 07:23:43.158224106 CEST	49779	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:43.167534113 CEST	49779	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:43.212124109 CEST	443	49779	34.117.186.192	192.168.2.4
May 3, 2024 07:23:43.387921095 CEST	443	49779	34.117.186.192	192.168.2.4
May 3, 2024 07:23:43.388029099 CEST	443	49779	34.117.186.192	192.168.2.4
May 3, 2024 07:23:43.388107061 CEST	49779	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:43.388324022 CEST	49779	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:43.388345957 CEST	443	49779	34.117.186.192	192.168.2.4
May 3, 2024 07:23:43.388356924 CEST	49779	443	192.168.2.4	34.117.186.192
May 3, 2024 07:23:43.388361931 CEST	443	49779	34.117.186.192	192.168.2.4
May 3, 2024 07:23:43.390408039 CEST	49780	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:43.390433073 CEST	443	49780	104.26.5.15	192.168.2.4
May 3, 2024 07:23:43.390522003 CEST	49780	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:43.390888929 CEST	49780	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:43.390899897 CEST	443	49780	104.26.5.15	192.168.2.4
May 3, 2024 07:23:43.401726961 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:43.401971102 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:43.576971054 CEST	443	49780	104.26.5.15	192.168.2.4
May 3, 2024 07:23:43.577033997 CEST	49780	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:43.581314087 CEST	49780	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:43.581324100 CEST	443	49780	104.26.5.15	192.168.2.4
May 3, 2024 07:23:43.581556082 CEST	443	49780	104.26.5.15	192.168.2.4
May 3, 2024 07:23:43.582978010 CEST	49780	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:43.628128052 CEST	443	49780	104.26.5.15	192.168.2.4
May 3, 2024 07:23:43.635765076 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:43.834742069 CEST	443	49780	104.26.5.15	192.168.2.4
May 3, 2024 07:23:43.834824085 CEST	443	49780	104.26.5.15	192.168.2.4
May 3, 2024 07:23:43.834870100 CEST	49780	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:43.835247993 CEST	49780	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:43.835267067 CEST	443	49780	104.26.5.15	192.168.2.4
May 3, 2024 07:23:43.835279942 CEST	49780	443	192.168.2.4	104.26.5.15
May 3, 2024 07:23:43.835284948 CEST	443	49780	104.26.5.15	192.168.2.4
May 3, 2024 07:23:43.836121082 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:44.073375940 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:44.155627966 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:44.203599930 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:44.251221895 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:44.495073080 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:44.977112055 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:45.031738043 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:48.001043081 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:48.189361095 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:48.995313883 CEST	58709	49763	147.45.47.93	192.168.2.4
May 3, 2024 07:23:48.995372057 CEST	49763	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:53.997654915 CEST	49781	443	192.168.2.4	20.12.23.50
May 3, 2024 07:23:53.997694969 CEST	443	49781	20.12.23.50	192.168.2.4
May 3, 2024 07:23:53.997756958 CEST	49781	443	192.168.2.4	20.12.23.50
May 3, 2024 07:23:53.998141050 CEST	49781	443	192.168.2.4	20.12.23.50
May 3, 2024 07:23:53.998157024 CEST	443	49781	20.12.23.50	192.168.2.4
May 3, 2024 07:23:54.301428080 CEST	443	49781	20.12.23.50	192.168.2.4
May 3, 2024 07:23:54.301505089 CEST	49781	443	192.168.2.4	20.12.23.50
May 3, 2024 07:23:54.304464102 CEST	49781	443	192.168.2.4	20.12.23.50
May 3, 2024 07:23:54.304471970 CEST	443	49781	20.12.23.50	192.168.2.4
May 3, 2024 07:23:54.304681063 CEST	443	49781	20.12.23.50	192.168.2.4
May 3, 2024 07:23:54.329503059 CEST	49781	443	192.168.2.4	20.12.23.50
May 3, 2024 07:23:54.372144938 CEST	443	49781	20.12.23.50	192.168.2.4
May 3, 2024 07:23:54.598121881 CEST	443	49781	20.12.23.50	192.168.2.4
May 3, 2024 07:23:54.598140001 CEST	443	49781	20.12.23.50	192.168.2.4
May 3, 2024 07:23:54.598159075 CEST	443	49781	20.12.23.50	192.168.2.4
May 3, 2024 07:23:54.598228931 CEST	49781	443	192.168.2.4	20.12.23.50
May 3, 2024 07:23:54.598253012 CEST	443	49781	20.12.23.50	192.168.2.4
May 3, 2024 07:23:54.598267078 CEST	443	49781	20.12.23.50	192.168.2.4
May 3, 2024 07:23:54.598320961 CEST	49781	443	192.168.2.4	20.12.23.50
May 3, 2024 07:23:54.603591919 CEST	49781	443	192.168.2.4	20.12.23.50
May 3, 2024 07:23:54.603607893 CEST	443	49781	20.12.23.50	192.168.2.4
May 3, 2024 07:23:54.603632927 CEST	49781	443	192.168.2.4	20.12.23.50
May 3, 2024 07:23:54.603637934 CEST	443	49781	20.12.23.50	192.168.2.4
May 3, 2024 07:23:57.292802095 CEST	58709	49744	147.45.47.93	192.168.2.4
May 3, 2024 07:23:57.292890072 CEST	49744	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:23:57.356004953 CEST	58709	49745	147.45.47.93	192.168.2.4
May 3, 2024 07:23:57.356116056 CEST	49745	58709	192.168.2.4	147.45.47.93
May 3, 2024 07:24:03.483042002 CEST	49783	443	192.168.2.4	142.250.176.196
May 3, 2024 07:24:03.483072042 CEST	443	49783	142.250.176.196	192.168.2.4
May 3, 2024 07:24:03.483134031 CEST	49783	443	192.168.2.4	142.250.176.196
May 3, 2024 07:24:03.483393908 CEST	49783	443	192.168.2.4	142.250.176.196
May 3, 2024 07:24:03.483407974 CEST	443	49783	142.250.176.196	192.168.2.4
May 3, 2024 07:24:03.667645931 CEST	443	49783	142.250.176.196	192.168.2.4
May 3, 2024 07:24:03.667911053 CEST	49783	443	192.168.2.4	142.250.176.196
May 3, 2024 07:24:03.667936087 CEST	443	49783	142.250.176.196	192.168.2.4
May 3, 2024 07:24:03.668822050 CEST	443	49783	142.250.176.196	192.168.2.4
May 3, 2024 07:24:03.668881893 CEST	49783	443	192.168.2.4	142.250.176.196
May 3, 2024 07:24:03.670972109 CEST	49783	443	192.168.2.4	142.250.176.196
May 3, 2024 07:24:03.671025038 CEST	443	49783	142.250.176.196	192.168.2.4
May 3, 2024 07:24:03.719811916 CEST	49783	443	192.168.2.4	142.250.176.196
May 3, 2024 07:24:03.719821930 CEST	443	49783	142.250.176.196	192.168.2.4
May 3, 2024 07:24:03.766686916 CEST	49783	443	192.168.2.4	142.250.176.196
May 3, 2024 07:24:13.689573050 CEST	443	49783	142.250.176.196	192.168.2.4
May 3, 2024 07:24:13.689631939 CEST	443	49783	142.250.176.196	192.168.2.4
May 3, 2024 07:24:13.689697027 CEST	49783	443	192.168.2.4	142.250.176.196
May 3, 2024 07:24:15.234348059 CEST	49783	443	192.168.2.4	142.250.176.196
May 3, 2024 07:24:15.234378099 CEST	443	49783	142.250.176.196	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 3, 2024 07:22:59.471795082 CEST	53	61640	1.1.1.1	192.168.2.4
May 3, 2024 07:22:59.497612953 CEST	53	59980	1.1.1.1	192.168.2.4
May 3, 2024 07:22:59.570148945 CEST	57439	53	192.168.2.4	8.8.8.8
May 3, 2024 07:22:59.570671082 CEST	51430	53	192.168.2.4	1.1.1.1
May 3, 2024 07:22:59.659003019 CEST	53	57439	8.8.8.8	192.168.2.4
May 3, 2024 07:22:59.659017086 CEST	53	51430	1.1.1.1	192.168.2.4
May 3, 2024 07:22:59.858989954 CEST	51063	53	192.168.2.4	1.1.1.1
May 3, 2024 07:22:59.947921991 CEST	53	51063	1.1.1.1	192.168.2.4
May 3, 2024 07:23:01.926069021 CEST	56128	53	192.168.2.4	1.1.1.1
May 3, 2024 07:23:02.015503883 CEST	53	56128	1.1.1.1	192.168.2.4
May 3, 2024 07:23:02.045484066 CEST	53	59334	1.1.1.1	192.168.2.4
May 3, 2024 07:23:02.486943007 CEST	57732	53	192.168.2.4	1.1.1.1
May 3, 2024 07:23:02.487102985 CEST	56105	53	192.168.2.4	1.1.1.1
May 3, 2024 07:23:02.576067924 CEST	53	56105	1.1.1.1	192.168.2.4
May 3, 2024 07:23:02.576425076 CEST	53	57732	1.1.1.1	192.168.2.4
May 3, 2024 07:23:11.241770983 CEST	51345	53	192.168.2.4	1.1.1.1
May 3, 2024 07:23:11.330077887 CEST	53	51345	1.1.1.1	192.168.2.4
May 3, 2024 07:23:19.000416040 CEST	138	138	192.168.2.4	192.168.2.255
May 3, 2024 07:23:19.074203014 CEST	53	56209	1.1.1.1	192.168.2.4
May 3, 2024 07:23:40.628925085 CEST	53	53970	1.1.1.1	192.168.2.4
May 3, 2024 07:23:58.984512091 CEST	53	63469	1.1.1.1	192.168.2.4
May 3, 2024 07:24:03.393942118 CEST	50185	53	192.168.2.4	1.1.1.1
May 3, 2024 07:24:03.394443989 CEST	58994	53	192.168.2.4	1.1.1.1
May 3, 2024 07:24:03.481671095 CEST	53	50185	1.1.1.1	192.168.2.4
May 3, 2024 07:24:03.482223988 CEST	53	58994	1.1.1.1	192.168.2.4
May 3, 2024 07:24:03.617961884 CEST	53	54347	1.1.1.1	192.168.2.4
May 3, 2024 07:24:26.973336935 CEST	53	59140	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 3, 2024 07:22:59.570148945 CEST	192.168.2.4	8.8.8.8	0xa9b9	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
May 3, 2024 07:22:59.570671082 CEST	192.168.2.4	1.1.1.1	0x21d8	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
May 3, 2024 07:22:59.858989954 CEST	192.168.2.4	1.1.1.1	0xd12e	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 3, 2024 07:23:01.926069021 CEST	192.168.2.4	1.1.1.1	0xe966	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
May 3, 2024 07:23:02.486943007 CEST	192.168.2.4	1.1.1.1	0xb9d8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 3, 2024 07:23:02.487102985 CEST	192.168.2.4	1.1.1.1	0x4b2d	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 3, 2024 07:23:11.241770983 CEST	192.168.2.4	1.1.1.1	0x855c	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 3, 2024 07:24:03.393942118 CEST	192.168.2.4	1.1.1.1	0x35cc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 3, 2024 07:24:03.394443989 CEST	192.168.2.4	1.1.1.1	0xe0da	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 3, 2024 07:22:59.659003019 CEST	8.8.8.8	192.168.2.4	0xa9b9	No error (0)	google.com	172.217.4.46	A (IP address)	IN (0x0001)	false
May 3, 2024 07:22:59.659017086 CEST	1.1.1.1	192.168.2.4	0x21d8	No error (0)	google.com	142.250.64.78	A (IP address)	IN (0x0001)	false
May 3, 2024 07:22:59.947921991 CEST	1.1.1.1	192.168.2.4	0xd12e	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
May 3, 2024 07:23:02.015503883 CEST	1.1.1.1	192.168.2.4	0xe966	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
May 3, 2024 07:23:02.015503883 CEST	1.1.1.1	192.168.2.4	0xe966	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
May 3, 2024 07:23:02.015503883 CEST	1.1.1.1	192.168.2.4	0xe966	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
May 3, 2024 07:23:02.576067924 CEST	1.1.1.1	192.168.2.4	0x4b2d	No error (0)	www.google.com		65	IN (0x0001)	false
May 3, 2024 07:23:02.576425076 CEST	1.1.1.1	192.168.2.4	0xb9d8	No error (0)	www.google.com	142.250.72.100	A (IP address)	IN (0x0001)	false
May 3, 2024 07:23:11.330077887 CEST	1.1.1.1	192.168.2.4	0x855c	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
May 3, 2024 07:24:03.481671095 CEST	1.1.1.1	192.168.2.4	0x35cc	No error (0)	www.google.com	142.250.176.196	A (IP address)	IN (0x0001)	false
May 3, 2024 07:24:03.482223988 CEST	1.1.1.1	192.168.2.4	0xe0da	No error (0)	www.google.com		65	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

www.google.com

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	34.117.186.192	443	796	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:01 UTC	239	OUT	GET /widget/demo/191.96.227.219 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-03 05:23:01 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 03 May 2024 05:23:01 GMT content-type: application/json; charset=utf-8 Content-Length: 921 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-03 05:23:01 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 31 37 34 20 43 6f 67 65 6e 74 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e Data Ascii: { "input": "191.96.227.219", "data": { "ip": "191.96.227.219", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS174 Cogent Communications", "postal": "10001", "timezon
2024-05-03 05:23:01 UTC	179	IN	Data Raw: 22 3a 20 22 50 72 69 76 61 74 65 20 52 65 73 69 64 65 6e 63 65 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 69 70 78 6f 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 50 72 69 76 61 74 65 20 43 75 73 74 6f 6d 65 72 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ": "Private Residence", "country": "US", "email": "abuse@ipxo.com", "name": "Private Customer", "network": "191.96.227.0/24", "phone": "" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	104.26.5.15	443	796	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:02 UTC	263	OUT	GET /demo/home.php?s=191.96.227.219 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-03 05:23:02 UTC	654	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 05:23:02 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9A7A:C5E0_93878F2E:0050_663474B6_B4E4BB9:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PbOGbXDSx4yEUXwH0OUxhP27ZyTFTi4AoEAbB14jyEscZZ%2F7gVnJ8sc5hUK0Jzejkk7FopGscSzhiapcTi22I%2BFsX6B3oCU4lI%2BJXRRJKZT7CHKKhU1XawQjOQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87ddd113cb1f42f1-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 05:23:02 UTC	664	IN	Data Raw: 32 39 31 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 Data Ascii: 291{"status":"ok","demoInfo":{"ipAddress":"191.96.227.219","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages
2024-05-03 05:23:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	142.250.72.100	443	7484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:02 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-03 05:23:03 UTC	1304	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/ddljson%3Fasync%3Dntp:2&q=EgS_YOPbGLbp0bEGIjDNZc3MZHlf1E0orMqnosUmz6W763DCXYHXDGytrbaZJcGJLjun_vRC8GiTovYLXb8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIt-nRsQYQ3bK_jQESBL9g49s Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 03 May 2024 05:23:03 GMT Server: gws Content-Length: 427 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-05-03-05; expires=Sun, 02-Jun-2024 05:23:03 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=EQD99ALJd6fOZu26GG9BtUjXBRf2gGBsuk5QaS83mUVQaqMpvZ4LNdhssAidlPr7GtfSBFeiMvNnnYNjxcnDCKLiRS44NSdXzIk9nQXC3r6txe-PaW2vKLuatBzEjiBpwv1s228V4FQEbPNYX_vzR8IICWLCpTWJe0qikJMZQ84; expires=Sat, 02-Nov-2024 05:23:02 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-03 05:23:03 UTC	427	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 64 64 6c 6a 73 6f 6e 25 33 46 61 73 79 6e Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/ddljson%3Fasyn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	142.250.72.100	443	7484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:02 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-03 05:23:03 UTC	1331	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YOPbGLbp0bEGIjA9RjS4dnTf9TMc_WNOZoEqYCGZPMusvyHbkcGkBp0b60YgEyf8aWQGPDnoAkT6yZQyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIt-nRsQYQjt37lAESBL9g49s Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 03 May 2024 05:23:03 GMT Server: gws Content-Length: 458 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-05-03-05; expires=Sun, 02-Jun-2024 05:23:03 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=APNOzOblleRB1aJFPx8Z_gRLPnRmzF3um8G7RczJpJHmMs2PjggLJuQJDSfSkkQEQw4W68eqU9PX_RTcXywZXXUq_AQqC0hF8Ap_QEpQOLc-nzbFkFzjdPZ3R_RYwXhxUJye9FK_ULZoYVxD6FGWtw5mxdI8GicRmXl8qJSIPUA; expires=Sat, 02-Nov-2024 05:23:02 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-03 05:23:03 UTC	458	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 25 33 46 68 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	142.250.72.100	443	7484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:02 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-03 05:23:03 UTC	1249	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YOPbGLfp0bEGIjBOCVhRAJULzteCOxPiY_X6uQIji4BS0T9mLaHtP_Am7ecKTeSvtZKtamBURy9fib0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIt-nRsQYQx_2imAESBL9g49s Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 03 May 2024 05:23:03 GMT Server: gws Content-Length: 417 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-05-03-05; expires=Sun, 02-Jun-2024 05:23:03 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=cj89ODLx9-NktihWgR6pcEkVLJtmzBmUJFxO5DHSM_Ex4E-3z8ovz6JNixtHvLzVH43EiHaIwe1tovaDxh4FgY0d0QihWT12B-WBStzI-FDmf6tkDRL3VTxmW2AgAZsr1Tppx2YUWmkCPuT4nscUI9perMpwKY6l9iEl-alk_30; expires=Sat, 02-Nov-2024 05:23:03 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-03 05:23:03 UTC	6	IN	Data Raw: 3c 48 54 4d 4c 3e Data Ascii: <HTML>
2024-05-03 05:23:03 UTC	411	IN	Data Raw: 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 26 61 6d 70 3b 71 3d Data Ascii: <HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	142.250.72.100	443	7484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:03 UTC	912	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YOPbGLbp0bEGIjA9RjS4dnTf9TMc_WNOZoEqYCGZPMusvyHbkcGkBp0b60YgEyf8aWQGPDnoAkT6yZQyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-05-03-05; NID=513=APNOzOblleRB1aJFPx8Z_gRLPnRmzF3um8G7RczJpJHmMs2PjggLJuQJDSfSkkQEQw4W68eqU9PX_RTcXywZXXUq_AQqC0hF8Ap_QEpQOLc-nzbFkFzjdPZ3R_RYwXhxUJye9FK_ULZoYVxD6FGWtw5mxdI8GicRmXl8qJSIPUA
2024-05-03 05:23:03 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 03 May 2024 05:23:03 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3185 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-03 05:23:03 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 3f 68 6c 3d 65 6e 2d 55 53 26 61 6d 70 3b 61 73 79 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_ogb?hl=en-US&asy
2024-05-03 05:23:03 UTC	1255	IN	Data Raw: 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 73 63 4b 39 4b 63 35 6d 33 Data Ascii: <script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="scK9Kc5m3
2024-05-03 05:23:03 UTC	1031	IN	Data Raw: 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 Data Ascii: ; line-height:1.4em;">This page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly aft

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	142.250.72.100	443	7484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:03 UTC	738	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YOPbGLfp0bEGIjBOCVhRAJULzteCOxPiY_X6uQIji4BS0T9mLaHtP_Am7ecKTeSvtZKtamBURy9fib0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-05-03-05; NID=513=cj89ODLx9-NktihWgR6pcEkVLJtmzBmUJFxO5DHSM_Ex4E-3z8ovz6JNixtHvLzVH43EiHaIwe1tovaDxh4FgY0d0QihWT12B-WBStzI-FDmf6tkDRL3VTxmW2AgAZsr1Tppx2YUWmkCPuT4nscUI9perMpwKY6l9iEl-alk_30
2024-05-03 05:23:03 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 03 May 2024 05:23:03 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3113 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-03 05:23:03 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_promos</title></head
2024-05-03 05:23:03 UTC	1255	IN	Data Raw: 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 34 71 32 34 74 72 4d 4b 4b 51 57 48 72 59 6a 38 79 5f 73 32 31 4f 76 70 45 4b 64 70 75 4e 59 64 6e Data Ascii: ack = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="4q24trMKKQWHrYj8y_s21OvpEKdpuNYdn
2024-05-03 05:23:03 UTC	959	IN	Data Raw: 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 73 6f 6c 76 69 6e Data Ascii: ogle automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime, solvin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	142.250.72.100	443	7484	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:03 UTC	742	OUT	GET /sorry/index?continue=https://www.google.com/async/ddljson%3Fasync%3Dntp:2&q=EgS_YOPbGLbp0bEGIjDNZc3MZHlf1E0orMqnosUmz6W763DCXYHXDGytrbaZJcGJLjun_vRC8GiTovYLXb8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-05-03-05; NID=513=EQD99ALJd6fOZu26GG9BtUjXBRf2gGBsuk5QaS83mUVQaqMpvZ4LNdhssAidlPr7GtfSBFeiMvNnnYNjxcnDCKLiRS44NSdXzIk9nQXC3r6txe-PaW2vKLuatBzEjiBpwv1s228V4FQEbPNYX_vzR8IICWLCpTWJe0qikJMZQ84
2024-05-03 05:23:03 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 03 May 2024 05:23:03 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3131 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-03 05:23:03 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 64 64 6c 6a 73 6f 6e 3f 61 73 79 6e 63 3d 6e 74 70 3a 32 3c 2f 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/ddljson?async=ntp:2</title>
2024-05-03 05:23:03 UTC	1255	IN	Data Raw: 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 64 5f 30 36 71 76 78 35 4a 56 4c 4f 6b 66 64 47 59 45 42 61 64 32 4c 39 70 75 65 Data Ascii: tCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="d_06qvx5JVLOkfdGYEBad2L9pue
2024-05-03 05:23:03 UTC	977	IN	Data Raw: 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e Data Ascii: ears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the mean

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49748	34.117.186.192	443	7212	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:11 UTC	239	OUT	GET /widget/demo/191.96.227.219 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-03 05:23:11 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 03 May 2024 05:23:11 GMT content-type: application/json; charset=utf-8 Content-Length: 921 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-03 05:23:11 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 31 37 34 20 43 6f 67 65 6e 74 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e Data Ascii: { "input": "191.96.227.219", "data": { "ip": "191.96.227.219", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS174 Cogent Communications", "postal": "10001", "timezon
2024-05-03 05:23:11 UTC	179	IN	Data Raw: 22 3a 20 22 50 72 69 76 61 74 65 20 52 65 73 69 64 65 6e 63 65 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 69 70 78 6f 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 50 72 69 76 61 74 65 20 43 75 73 74 6f 6d 65 72 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ": "Private Residence", "country": "US", "email": "abuse@ipxo.com", "name": "Private Customer", "network": "191.96.227.0/24", "phone": "" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49749	34.117.186.192	443	6788	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:11 UTC	239	OUT	GET /widget/demo/191.96.227.219 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-03 05:23:11 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 03 May 2024 05:23:11 GMT content-type: application/json; charset=utf-8 Content-Length: 921 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-03 05:23:11 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 31 37 34 20 43 6f 67 65 6e 74 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e Data Ascii: { "input": "191.96.227.219", "data": { "ip": "191.96.227.219", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS174 Cogent Communications", "postal": "10001", "timezon
2024-05-03 05:23:11 UTC	179	IN	Data Raw: 22 3a 20 22 50 72 69 76 61 74 65 20 52 65 73 69 64 65 6e 63 65 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 69 70 78 6f 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 50 72 69 76 61 74 65 20 43 75 73 74 6f 6d 65 72 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ": "Private Residence", "country": "US", "email": "abuse@ipxo.com", "name": "Private Customer", "network": "191.96.227.0/24", "phone": "" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49750	23.51.58.94	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:11 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-03 05:23:12 UTC	465	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=6055 Date: Fri, 03 May 2024 05:23:12 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49752	104.26.5.15	443	7212	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:12 UTC	263	OUT	GET /demo/home.php?s=191.96.227.219 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-03 05:23:12 UTC	658	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 05:23:12 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC4673C3:5952_93878F2E:0050_663474C0_B4E4C94:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y6W4781m%2F5EJqwG9GBY1a4tm4fQYDE1412XKEAoBLFATItk6ivyztiymIr54WcBbXWluAszwQ%2F23LxUpH6Hu5dBhuLgyXR4eA19qGtq%2BbMak%2FJkoXWi%2BXWHOGw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87ddd1516e387274-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 05:23:12 UTC	664	IN	Data Raw: 32 39 31 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 Data Ascii: 291{"status":"ok","demoInfo":{"ipAddress":"191.96.227.219","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages
2024-05-03 05:23:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	104.26.5.15	443	6788	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:12 UTC	263	OUT	GET /demo/home.php?s=191.96.227.219 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-03 05:23:12 UTC	658	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 05:23:12 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9A19:C7F2_93878F2E:0050_663474C0_B4C5274:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F0v2MM5griYLm%2B3iyu0W17ed3%2FAz0S%2FwaQ17B0j313HfZUagx8XAOs7IOUuCaWmCCS3xAQhURyeyALABZVIUhMs6gzREWYQFegs%2BCgQAbO3r%2FcJct20TNR6icg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87ddd1516d14443e-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 05:23:12 UTC	664	IN	Data Raw: 32 39 31 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 Data Ascii: 291{"status":"ok","demoInfo":{"ipAddress":"191.96.227.219","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages
2024-05-03 05:23:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	23.51.58.94	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:12 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-03 05:23:12 UTC	454	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 Cache-Control: public, max-age=6033 Date: Fri, 03 May 2024 05:23:12 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-03 05:23:12 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49751	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:12 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=obBedr2UOoU2yNe&MD=DdSnfapD HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-03 05:23:12 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d2e3ab4f-2190-4cbd-b966-bde5eb0cb6c5 MS-RequestId: 8f14ba4d-c217-4fc2-892c-1e111b81ff03 MS-CV: +ErNyyvdP0qRJaNp.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 03 May 2024 05:23:12 GMT Connection: close Content-Length: 24490
2024-05-03 05:23:12 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-05-03 05:23:12 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49761	34.117.186.192	443	8700	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:20 UTC	239	OUT	GET /widget/demo/191.96.227.219 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-03 05:23:20 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 03 May 2024 05:23:20 GMT content-type: application/json; charset=utf-8 Content-Length: 921 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-03 05:23:20 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 31 37 34 20 43 6f 67 65 6e 74 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e Data Ascii: { "input": "191.96.227.219", "data": { "ip": "191.96.227.219", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS174 Cogent Communications", "postal": "10001", "timezon
2024-05-03 05:23:20 UTC	179	IN	Data Raw: 22 3a 20 22 50 72 69 76 61 74 65 20 52 65 73 69 64 65 6e 63 65 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 69 70 78 6f 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 50 72 69 76 61 74 65 20 43 75 73 74 6f 6d 65 72 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ": "Private Residence", "country": "US", "email": "abuse@ipxo.com", "name": "Private Customer", "network": "191.96.227.0/24", "phone": "" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49762	104.26.5.15	443	8700	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:20 UTC	263	OUT	GET /demo/home.php?s=191.96.227.219 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-03 05:23:20 UTC	658	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 05:23:20 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9AFC:8BB8_93878F2E:0050_663474C8_B4C5326:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YqHZDF0jfk22Piw%2FvjOrAxSevNxCVR5KrWPZGO1A1tMTVOhJTEsz%2FMGzmErnVomFPchPujxRBTD31p6LCrii814GgddAV3Nw2nNaTINci%2Ft%2FWrybsXCx%2B8iccw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87ddd1861d5b439a-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 05:23:20 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-03 05:23:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49764	40.126.24.82	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:25 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-05-03 05:23:25 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-03 05:23:26 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 03 May 2024 05:22:25 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BAY x-ms-request-id: 15c30aba-5b2a-4129-9f9d-d42b76d564e2 PPServer: PPV: 30 H: PH1PEPF00011DAB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 03 May 2024 05:23:25 GMT Connection: close Content-Length: 1276
2024-05-03 05:23:26 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49765	40.126.24.82	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:28 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-05-03 05:23:28 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 72 7a 79 69 75 75 65 64 7a 68 76 63 63 78 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 36 59 6c 2e 73 79 7e 60 79 7e 6a 4d 73 74 4b 71 63 36 33 28 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02rzyiuuedzhvccx</Membername><Password>6Yl.sy~`y~jMstKqc63(</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-05-03 05:23:31 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Fri, 03 May 2024 05:22:29 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_BL2 x-ms-request-id: bd025200-b844-4844-baf5-541e476ffccd PPServer: PPV: 30 H: BL02EPF0001D909 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 03 May 2024 05:23:30 GMT Connection: close Content-Length: 17166
2024-05-03 05:23:31 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 30 45 45 37 31 34 37 45 44 34 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 32 66 35 64 64 61 61 37 2d 30 30 38 64 2d 34 34 64 64 2d 62 62 34 64 2d 38 33 30 38 36 38 33 31 66 38 61 33 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018800EE7147ED4</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="2f5ddaa7-008d-44dd-bb4d-83086831f8a3" LicenseID="3252b20c-d425-4711
2024-05-03 05:23:31 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49766	40.126.24.82	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:31 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-05-03 05:23:31 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-03 05:23:34 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 03 May 2024 05:22:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: 5291818b-f910-4665-ab79-ded868c6ddb9 PPServer: PPV: 30 H: BL02EPF0001D9F4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 03 May 2024 05:23:34 GMT Connection: close Content-Length: 11392
2024-05-03 05:23:34 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49767	40.126.24.82	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-05-03 05:23:35 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-03 05:23:35 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 03 May 2024 05:22:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BL2 x-ms-request-id: c45259ba-1a67-4608-95ea-cc364c658cb9 PPServer: PPV: 30 H: BL02EPF0001DA30 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 03 May 2024 05:23:34 GMT Connection: close Content-Length: 1918
2024-05-03 05:23:35 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49768	40.126.24.82	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-05-03 05:23:35 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-03 05:23:36 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 03 May 2024 05:22:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BL2 x-ms-request-id: 8435d7f6-a1ee-4d76-8bd9-73b4941da4d4 PPServer: PPV: 30 H: BL02EPF0001D88C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 03 May 2024 05:23:35 GMT Connection: close Content-Length: 1918
2024-05-03 05:23:36 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49769	40.126.24.82	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-05-03 05:23:35 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-03 05:23:36 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 03 May 2024 05:22:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: 5eb1a2b5-5fcf-4853-a51c-3b8bcbe666d4 PPServer: PPV: 30 H: BL02EPF0001DA05 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 03 May 2024 05:23:36 GMT Connection: close Content-Length: 11392
2024-05-03 05:23:36 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49770	40.126.24.82	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:36 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-05-03 05:23:36 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-03 05:23:37 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 03 May 2024 05:22:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30185.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: ef41ace5-7f0c-43de-a112-2715d953dd39 PPServer: PPV: 30 H: BL02EPF0001D903 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 03 May 2024 05:23:36 GMT Connection: close Content-Length: 11392
2024-05-03 05:23:37 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49771	40.126.24.82	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:37 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-05-03 05:23:37 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-03 05:23:37 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 03 May 2024 05:22:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30185.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: 14336414-b926-408e-b2b7-d64a254c9917 PPServer: PPV: 30 H: BL02EPF0001D906 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 03 May 2024 05:23:36 GMT Connection: close Content-Length: 11392
2024-05-03 05:23:37 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49773	40.126.24.82	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:38 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-05-03 05:23:38 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-03 05:23:38 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 03 May 2024 05:22:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30185.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: f13df56f-9b72-4cc1-994e-e620a6c578a4 PPServer: PPV: 30 H: BL02EPF0001D907 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 03 May 2024 05:23:38 GMT Connection: close Content-Length: 11392
2024-05-03 05:23:38 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49775	40.126.24.82	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:38 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-05-03 05:23:38 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-03 05:23:38 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 03 May 2024 05:22:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: 91766e2a-1aff-4e2b-b404-d33f75e8d1b9 PPServer: PPV: 30 H: BL02EPF0001D8E5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 03 May 2024 05:23:38 GMT Connection: close Content-Length: 11392
2024-05-03 05:23:38 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49779	34.117.186.192	443	9080	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:43 UTC	239	OUT	GET /widget/demo/191.96.227.219 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-03 05:23:43 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 03 May 2024 05:23:43 GMT content-type: application/json; charset=utf-8 Content-Length: 921 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-03 05:23:43 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 31 37 34 20 43 6f 67 65 6e 74 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e Data Ascii: { "input": "191.96.227.219", "data": { "ip": "191.96.227.219", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS174 Cogent Communications", "postal": "10001", "timezon
2024-05-03 05:23:43 UTC	179	IN	Data Raw: 22 3a 20 22 50 72 69 76 61 74 65 20 52 65 73 69 64 65 6e 63 65 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 69 70 78 6f 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 50 72 69 76 61 74 65 20 43 75 73 74 6f 6d 65 72 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 39 31 2e 39 36 2e 32 32 37 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ": "Private Residence", "country": "US", "email": "abuse@ipxo.com", "name": "Private Customer", "network": "191.96.227.0/24", "phone": "" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49780	104.26.5.15	443	9080	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:43 UTC	263	OUT	GET /demo/home.php?s=191.96.227.219 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-03 05:23:43 UTC	656	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 05:23:43 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46725E:C6EA_93878F2E:0050_663474DF_B4C5509:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eXTHwOmGwI0oaYJuDa%2BdswclUlrRNEwac1b7iP%2BL9WT8CCC03LY%2B7oeKvjUWmtqsmZCYoVPYvgIGbeeaSUqbfx9kfvyU9CDEm0Suc7dhUx%2FlutGWQuwNq55xIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87ddd21668578cca-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 05:23:43 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-03 05:23:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49781	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-05-03 05:23:54 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=obBedr2UOoU2yNe&MD=DdSnfapD HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-03 05:23:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 200aea08-d0cf-4c8b-880d-7cc0dc5f32ab MS-RequestId: f9fd1eb7-b586-4b1d-a606-216cfdafb4a4 MS-CV: 6UuE6S7Eski2zvus.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 03 May 2024 05:23:54 GMT Connection: close Content-Length: 25457
2024-05-03 05:23:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-05-03 05:23:54 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	07:22:51
Start date:	03/05/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe"
Imagebase:	0x580000
File size:	3'197'440 bytes
MD5 hash:	8D6E0FA54DF379D380222A4051AB848C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1901048371.0000000001983000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1901198665.0000000001994000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1901048371.0000000001993000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2086799247.000000000183E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2087269629.0000000001983000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2086799247.00000000018DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:22:55
Start date:	03/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x530000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:22:55
Start date:	03/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:22:55
Start date:	03/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x530000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:22:55
Start date:	03/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:22:57
Start date:	03/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	07:22:57
Start date:	03/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:22:57
Start date:	03/05/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x760000
File size:	3'197'440 bytes
MD5 hash:	8D6E0FA54DF379D380222A4051AB848C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2104214514.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.2104666258.000000000186E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.1997073810.0000000001890000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.1996378466.0000000001890000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.1996163003.0000000001890000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.2027506796.0000000001892000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.2104822243.0000000001894000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.2104214514.000000000173D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.2027559370.000000000186E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 50%, ReversingLabs Detection: 58%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:22:57
Start date:	03/05/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x760000
File size:	3'197'440 bytes
MD5 hash:	8D6E0FA54DF379D380222A4051AB848C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.2092162134.0000000001A27000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.2092743314.0000000001B18000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2092162134.0000000001AB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000003.2025987376.0000000001B61000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000003.2026230623.0000000001B6B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000003.2026205617.0000000001B62000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.2092977467.0000000001B6C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000003.2025987376.0000000001B16000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:22:57
Start date:	03/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2032,i,13373424599956482758,2622410995844212760,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:22:58
Start date:	03/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1904,i,4433995280801359943,15790253874222841577,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:23:10
Start date:	03/05/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x720000
File size:	3'197'440 bytes
MD5 hash:	8D6E0FA54DF379D380222A4051AB848C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.2099657926.0000000001AB2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000D.00000002.2099657926.0000000001A2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 50%, ReversingLabs Detection: 58%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:23:15
Start date:	03/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 --field-trial-handle=2032,i,13373424599956482758,2622410995844212760,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	07:23:19
Start date:	03/05/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x720000
File size:	3'197'440 bytes
MD5 hash:	8D6E0FA54DF379D380222A4051AB848C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:23:19
Start date:	03/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 1980
Imagebase:	0xd50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:23:31
Start date:	03/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8700 -s 2004
Imagebase:	0xd50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	07:23:31
Start date:	03/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7212 -s 1260
Imagebase:	0xd50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	07:23:32
Start date:	03/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 1896
Imagebase:	0xd50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	46.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	58

Executed Functions

Function 00627D20 Relevance: 420.8, APIs: 10, Strings: 219, Instructions: 20001COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00627D97

Part of subcall function 006433B0: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 006434EF

Strings

4oST, xrefs: 0063C5A1
P081, xrefs: 006329BC
4oST, xrefs: 00630E27
4oST, xrefs: 0064219B
4oST, xrefs: 00640BAA
4oST, xrefs: 006429A5
4oST, xrefs: 00632859
4oST, xrefs: 00636657
UYw, xrefs: 0063A29A
4oST, xrefs: 006328E3
4oST, xrefs: 006372FD
4oST, xrefs: 00632F8C
4oST, xrefs: 00628A68
4oST, xrefs: 00634B47
4oST, xrefs: 0063A9D8
Q z, xrefs: 0062C25D
4oST, xrefs: 00642527
4oST, xrefs: 00630086
4oST, xrefs: 0063DF50
4oST, xrefs: 00637072
4oST, xrefs: 006411DD
UWy, xrefs: 0063ABF5
4oST, xrefs: 0063E4AD
4oST, xrefs: 00642F91
wWs, xrefs: 00631E24
4oST, xrefs: 00638F9B
4oST, xrefs: 00632A0E
&I, xrefs: 00639F50
WGf, xrefs: 0063A960
x<, xrefs: 00641BC4
#iR@, xrefs: 00638320
4oST, xrefs: 00628619
4oST, xrefs: 006288EA
P081, xrefs: 0063766B
4oST, xrefs: 0062852A
4oST, xrefs: 00632EF1
4oST, xrefs: 00639324
4oST, xrefs: 00641A86
4oST, xrefs: 00638BDC
4oST, xrefs: 0064122F
4oST, xrefs: 00640673
4oST, xrefs: 006366A9
4oST, xrefs: 0063E283
#iR@, xrefs: 0063A0D0
4oST, xrefs: 006378D2
4oST, xrefs: 006426C3
v}{, xrefs: 0063379F
vo, xrefs: 0062E9ED, 006309BD, 0063588D, 0063B77D, 0063D45D, 0063F2DD
4oST, xrefs: 0063A312
4oST, xrefs: 0063F5C2
4oST, xrefs: 0063DE6D
4oST, xrefs: 00634C76
4oST, xrefs: 0063C198
4oST, xrefs: 006373DD
4oST, xrefs: 0063791E
4oST, xrefs: 0062B120
4oST, xrefs: 006420BE
^W`, xrefs: 0063763D
cannot use push_back() with , xrefs: 0062E46B, 0062E6E3, 00630717, 00630908, 00635646, 006357DE, 0063B379, 0063B3D0, 0063B424, 0063D1D3, 0063D3AB, 0063F089, 0063F230, 0064330A
4oST, xrefs: 0064206C
4oST, xrefs: 0062E53E
4oST, xrefs: 0064073D
Q z, xrefs: 00631C9F
4oST, xrefs: 00630C48
4oST, xrefs: 00642677
WS{, xrefs: 00642F65
4oST, xrefs: 006415EC
4oST, xrefs: 00639078
4oST, xrefs: 00642BF5
4oST, xrefs: 0063A75B
Q z, xrefs: 00640473
4oST, xrefs: 00632EA5
4oST, xrefs: 0063AC6D
V!T, xrefs: 006392D2
4oST, xrefs: 006375E4
4oST, xrefs: 0063C2C7
0aVM, xrefs: 00641A18
4oST, xrefs: 006335B1
4oST, xrefs: 00639F9C
4oST, xrefs: 00639026
HFd, xrefs: 0062DA41
4oST, xrefs: 00636C71
4oST, xrefs: 00642959
HWg, xrefs: 0063438A
4oST, xrefs: 00633DBF
4oST, xrefs: 00640234
4oST, xrefs: 00632C69
^W`, xrefs: 00641288
4oST, xrefs: 00640ED1
4oST, xrefs: 006424DB
4oST, xrefs: 00640969
x<, xrefs: 0063832A
4oST, xrefs: 00637CF1
&I, xrefs: 0063A154
v}{, xrefs: 006383DA
x<, xrefs: 0063A0DA
x<, xrefs: 0062FAFC
l$r,, xrefs: 00641906
4oST, xrefs: 006300D2
4oST, xrefs: 00640789
4oST, xrefs: 00637B6A
4oST, xrefs: 00642E29
4oST, xrefs: 00635AD6
_C|, xrefs: 0063CF2C
4oST, xrefs: 00640B5E
4oST, xrefs: 006353D1
4oST, xrefs: 00636F3A
4oST, xrefs: 0064107A
UWy, xrefs: 00639871
4oST, xrefs: 00642FDD
4oST, xrefs: 00635385
wWs, xrefs: 006405F8
Q z, xrefs: 006369A7
4oST, xrefs: 0063678A
4oST, xrefs: 0063465C
4oST, xrefs: 00634849
GG), xrefs: 006418B8
4oST, xrefs: 0063AC21
4oST, xrefs: 0063734F
4oST, xrefs: 00641028
4oST, xrefs: 006355DA
4oST, xrefs: 0063AF48
4oST, xrefs: 00632C1D
4oST, xrefs: 0062AFB5
4oST, xrefs: 00640517
UYw, xrefs: 00638628
4oST, xrefs: 00640A26
4oST, xrefs: 0062DE7C
4oST, xrefs: 0063D002
4oST, xrefs: 0063989D
4oST, xrefs: 006415A0
4oST, xrefs: 006367D6
4oST, xrefs: 00637CA5
&I, xrefs: 0062FB82
4oST, xrefs: 0063A70F
4oST, xrefs: 0063196F
MXg, xrefs: 006350CE
4oST, xrefs: 00636BA7
X[y, xrefs: 00635556
l$r-, xrefs: 00639ECC
4oST, xrefs: 00642149
\oST, xrefs: 0063A4EC
4oST, xrefs: 0063DBDC
4oST, xrefs: 00631D43
4oST, xrefs: 0062E27A
4oST, xrefs: 0063C27B
4oST, xrefs: 00632FDE
#iR@, xrefs: 00641BBA
FoST, xrefs: 0063A98C
4oST, xrefs: 00640F1D
4oST, xrefs: 00642BA9
4oST, xrefs: 00634065
wWs, xrefs: 006408F1
4oST, xrefs: 00633BEB
4oST, xrefs: 00639BAB
4oST, xrefs: 00637508
4oST, xrefs: 0063D696
4oST, xrefs: 0062F38F
4oST, xrefs: 0062DECE
4oST, xrefs: 00633D73
4oST, xrefs: 0063311A
4oST, xrefs: 00641153
4oST, xrefs: 006305B7
4oST, xrefs: 00641308
4oST, xrefs: 0062B16C
4oST, xrefs: 00631FB5
XFv, xrefs: 0063B0F9
4oST, xrefs: 00630CFC
4oST, xrefs: 0063D535
^W`, xrefs: 006410D3
P081, xrefs: 006412B6
#iR@, xrefs: 006336E5
4oST, xrefs: 00634B99
4oST, xrefs: 00640280
4oST, xrefs: 0063E45B
4oST, xrefs: 0063EF35
4oST, xrefs: 00629542
4oST, xrefs: 0063A538
4oST, xrefs: 006400FC
YX~, xrefs: 006395BD
WS{, xrefs: 00642B7D
4oST, xrefs: 0063E7A6
4oST, xrefs: 0063D6CA
4oST, xrefs: 00637592
4oST, xrefs: 006414B7
4oST, xrefs: 0062DFAB
v}{, xrefs: 0062FBB2
4oST, xrefs: 0063DBA8
4oST, xrefs: 00634019
4oST, xrefs: 0062DF59
4oST, xrefs: 00638F49
4oST, xrefs: 0063C146
4oST, xrefs: 0063FFF8
4oST, xrefs: 00639690
XFv, xrefs: 006392A6
4oST, xrefs: 00631F69
P081, xrefs: 00641101
4oST, xrefs: 00630DD5
&\U, xrefs: 0062909E
4oST, xrefs: 00641465
4oST, xrefs: 00640A78
4oST, xrefs: 00630D48
wWs, xrefs: 00632129
4oST, xrefs: 0064014E
KGa, xrefs: 00642DB1
4oST, xrefs: 0063191D
&I, xrefs: 00641C4A
cannot use operator[] with a string argument with , xrefs: 0062E8A5, 0062E8DD, 0062E930, 0062E965, 0062E99C, 00630872, 006308B0, 00630965, 006357A4, 0063583D, 0063B31D, 0063B484, 0063B4D9, 0063B52E, 0063B589, 0063B5DE, 0063B633, 0063B688, 0063B6DD, 0063B732, 0063D315, 0063D353, 0063D408, 0063F19A, 0063F1D8, 0063F28D, 00643298, 006432D0, 00643362
4oST, xrefs: 00642DDD
v}{, xrefs: 00641C7A
4oST, xrefs: 0063AEFC
4oST, xrefs: 0063F576
4oST, xrefs: 0063B12B
UP~, xrefs: 00633381
MXg, xrefs: 0063EA0D
4oST, xrefs: 00629693
4oST, xrefs: 006394B0
4oST, xrefs: 0062E22E
4oST, xrefs: 0063945E

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: #iR@$#iR@$#iR@$#iR@$&\U$&I$&I$&I$&I$0aVM$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$FoST$GG)$HFd$HWg$KGa$MXg$MXg$P081$P081$P081$P081$Q z$Q z$Q z$Q z$UP~$UWy$UWy$UYw$UYw$V!T$WGf$WS{$WS{$XFv$XFv$X[y$YX~$\oST$^W`$^W`$^W`$_C|$cannot use operator[] with a string argument with $cannot use push_back() with $l$r,$l$r-$v}{$v}{$v}{$v}{$wWs$wWs$wWs$wWs$vo$x<$x<$x<$x<
API String ID: 2195519125-2153658087
Opcode ID: 62f8f13e6466af9a096774651264851df4e3e762cdb043724113c5c180ff6438
Instruction ID: 0477ee0195f558650f4548846fc5b2f24df0243786a8af6b5644e60187950aba
Opcode Fuzzy Hash: 62f8f13e6466af9a096774651264851df4e3e762cdb043724113c5c180ff6438
Instruction Fuzzy Hash: 90B401B4D052A98BDB25CF68C994BEDBBB1BF49304F1081D9E849A7241DB306F85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0061CBF0 Relevance: 248.2, APIs: 6, Strings: 134, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0061CD44
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0061CE42
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0061D035
CreateDirectoryA.KERNEL32(?,00000000), ref: 0061F796

Part of subcall function 00664050: GetFileAttributesA.KERNELBASE(?,?,00000006,00000005,00000005), ref: 006640AC
Part of subcall function 00664050: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 006640B7

CreateDirectoryA.KERNEL32(?,00000000), ref: 0061FA7D
lstrlen.KERNEL32(?), ref: 00620FAE

Strings

4oST, xrefs: 0061F38D
4oST, xrefs: 0061CFD8
P?2', xrefs: 0061F1D8
4oST, xrefs: 0061DC4E
4oST, xrefs: 006200CA
4oST, xrefs: 0061D2A8
4oST, xrefs: 0061F8A7
gQ`, xrefs: 00620BE1
4oST, xrefs: 0061FB0E
WS{, xrefs: 0061E1EA
3gX, xrefs: 0061D1A8
4oST, xrefs: 0061E05E
4oST, xrefs: 0061DE89
4oST, xrefs: 0061F476
4oST, xrefs: 00620B48
WS{, xrefs: 0061E681
4oST, xrefs: 0061DA28
4oST, xrefs: 0061F12A
gQk, xrefs: 0061FC4F
4oST, xrefs: 0061F5C2
4oST, xrefs: 0061EEDE
4oST, xrefs: 00620116
4oST, xrefs: 0061FD8D
4oST, xrefs: 0061E262
4oST, xrefs: 0061F03B
4oST, xrefs: 0061EB9A
g[u, xrefs: 0061D198
4oST, xrefs: 00620D70
*ct, xrefs: 0061E9D6
gQk, xrefs: 0061FF9B
VoST, xrefs: 00620C0D
XFf, xrefs: 00620CF0
4oST, xrefs: 00620830
4oST, xrefs: 0061DC9A
WS{, xrefs: 0061F0AC
WS{, xrefs: 0061DE5D
4oST, xrefs: 0061E216
4oST, xrefs: 0061D3E5
VoST, xrefs: 006208F1
gQk, xrefs: 0061FA87
4oST, xrefs: 0061F27C
*ct, xrefs: 0061EABB
4oST, xrefs: 00620C5F
4oST, xrefs: 006202F2
4oST, xrefs: 0061F920
4oST, xrefs: 0061F576
4oST, xrefs: 0062071F
4oST, xrefs: 00620403
4oST, xrefs: 0061EDA4
4oST, xrefs: 0061EA1E
PM&, xrefs: 00620272
4oST, xrefs: 0061F3D9
4oST, xrefs: 0061EB03
k,6&, xrefs: 0061F6AA
4oST, xrefs: 0061D2FA
gQ`, xrefs: 006206A1
4oST, xrefs: 0061D9DC
4oST, xrefs: 0061FFD0
4oST, xrefs: 0061F6FC
4oST, xrefs: 00620AA0
4oST, xrefs: 0061E6AD
4oST, xrefs: 00620D24
4oST, xrefs: 00620B94
4oST, xrefs: 006201E1
gQ`, xrefs: 006204D9
4oST, xrefs: 00620560
4oST, xrefs: 0061FC02
4oST, xrefs: 006203B1
VoST, xrefs: 006206CD
gQ`, xrefs: 00620DFF
4oST, xrefs: 0061D0B3
cannot use push_back() with , xrefs: 00621038
4oST, xrefs: 006202A6
4oST, xrefs: 0061CE7D
#iR@, xrefs: 0061D7C4
4oST, xrefs: 0061D067
VoST, xrefs: 0062050E
4oST, xrefs: 0061EC6F
4oST, xrefs: 0061EBE6
gQk, xrefs: 00620163
4oST, xrefs: 0061E80A
4oST, xrefs: 0061DED5
4oST, xrefs: 0061EFE9
VoST, xrefs: 00620A4E
4oST, xrefs: 0061E61F
k@z, xrefs: 0061CF59
P: 1, xrefs: 0061EE3A
4oST, xrefs: 006207E4
4oST, xrefs: 0061E85C
4oST, xrefs: 0061ED58
x<, xrefs: 0061D7CE
PM!, xrefs: 0061FD5E
4oST, xrefs: 0061FC7B
4oST, xrefs: 0061FEC5
4oST, xrefs: 0061FDDF
4oST, xrefs: 0061ECC1
4oST, xrefs: 0061FABC
4oST, xrefs: 0061F0D8
4oST, xrefs: 00620654
4oST, xrefs: 0061D21C
4oST, xrefs: 0061FBB6
gQ`, xrefs: 00620A19
4oST, xrefs: 0061F972
WS{, xrefs: 0061F54A
4oST, xrefs: 0061CF85
gQ`, xrefs: 006208BF
VoST, xrefs: 00620E31
4oST, xrefs: 00620022
4oST, xrefs: 00620608
4oST, xrefs: 00620943
4oST, xrefs: 00620E83
^W`, xrefs: 0061EE0E
WS{, xrefs: 0061E5A1
4oST, xrefs: 0061E6FF
gQk, xrefs: 0061FE41
gQk, xrefs: 0062037F
^W`, xrefs: 0061F1AC
4oST, xrefs: 0061CDC3
4oST, xrefs: 0061D68A
4oST, xrefs: 0061FE73
cannot use operator[] with a string argument with , xrefs: 00621091, 006210E6
KGa, xrefs: 0061E032
4oST, xrefs: 0061E938
4oST, xrefs: 0061FCCD
KGa, xrefs: 0061F44A
4oST, xrefs: 0061E5CD
XFf, xrefs: 006207B0
SGf, xrefs: 0061EC3E
4oST, xrefs: 0061CECF
*ct, xrefs: 0061E8F6
4oST, xrefs: 0061E0AA
4oST, xrefs: 0061F4C8
4oST, xrefs: 0061F85B
4oST, xrefs: 0062018F

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: #iR@$3gX$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$KGa$KGa$P: 1$P?2'$PM!$PM&$SGf$VoST$VoST$VoST$VoST$VoST$VoST$WS{$WS{$WS{$WS{$WS{$WS{$XFf$XFf$^W`$^W`$cannot use operator[] with a string argument with $cannot use push_back() with $gQ`$gQ`$gQ`$gQ`$gQ`$gQ`$gQk$gQk$gQk$gQk$gQk$gQk$g[u$k,6&$k@z$*ct$*ct$*ct$x<
API String ID: 2833034228-1554121391
Opcode ID: 3c16719bd0e04f135cc6fac38773c8c67dcdbdbc44aa0bf16e6f8fc56770d810
Instruction ID: 991490cd13c0e333b1729eeb5fe32c6f901e65a9d7f5f15a08b87a7125e1467b
Opcode Fuzzy Hash: 3c16719bd0e04f135cc6fac38773c8c67dcdbdbc44aa0bf16e6f8fc56770d810
Instruction Fuzzy Hash: 6193DBB4D056A98ADB65CF28C990BDDBBB1BF49304F1081DAE84DA7241DB306BC5CF46

Uniqueness

Uniqueness Score: -1.00%

Function 0065D2B0 Relevance: 115.9, APIs: 48, Strings: 16, Instructions: 3939registrytimefileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 0065D4BB
CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,006E2B0C,00000001,0000002E,0000002F,?,006D83D1,3"Y,006D83D1), ref: 0065D78B
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0065D906
FindNextFileA.KERNEL32(00000000,?), ref: 0065D91C
FindClose.KERNEL32(00000000), ref: 0065D92C
GetLastError.KERNEL32 ref: 0065D932
GetLastError.KERNEL32 ref: 0065D950

Part of subcall function 00664590: GetCurrentProcess.KERNEL32(0065DCB0), ref: 0066459F
Part of subcall function 00664590: IsWow64Process.KERNEL32(00000000), ref: 006645A6

Part of subcall function 005C195B: GetSystemTimeAsFileTime.KERNEL32(0065DE28,00000000,00000000,?,?,?,0065DE28,00000000), ref: 005C1970
Part of subcall function 005C195B: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005C198F

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?,?,?), ref: 0065E0E1
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 0065E1AD
RegCloseKey.ADVAPI32(?), ref: 0065E1E2
GetCurrentHwProfileA.ADVAPI32(?), ref: 0065E37A
GetModuleHandleExA.KERNEL32(00000004,00663370,?,?,?,?,?,?,?,?,00000000), ref: 0065E87B
GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,?,?,?,?,?,00000000), ref: 0065E893
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?), ref: 0065F246
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 0065F312
RegCloseKey.ADVAPI32(?), ref: 0065F591
GetComputerNameA.KERNEL32(?,?), ref: 0065F5C5
GetUserNameA.ADVAPI32(?,?), ref: 0065F763
GetDesktopWindow.USER32 ref: 0065F806
GetWindowRect.USER32(00000000,?), ref: 0065F814
GetUserDefaultLocaleName.KERNEL32(?,00000200), ref: 0065F97F
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0065FE45
LocalAlloc.KERNEL32(00000040), ref: 0065FE57
GetKeyboardLayoutList.USER32(?,00000000), ref: 0065FE72
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0065FE9D
LocalFree.KERNEL32(?), ref: 00660060
GetLocalTime.KERNEL32(?), ref: 00660077
GetSystemTime.KERNEL32(?), ref: 0066028D
GetTimeZoneInformation.KERNELBASE(?), ref: 006602B0
TzSpecificLocalTimeToSystemTime.KERNELBASE(?,?,?), ref: 006602D5
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 006606EF
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 00660841
RegCloseKey.ADVAPI32(?), ref: 006608F2
GetSystemInfo.KERNELBASE(?), ref: 0066091A
GlobalMemoryStatusEx.KERNELBASE(?), ref: 006609CD
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00661003
Process32First.KERNEL32(00000000,?), ref: 0066101B
Process32Next.KERNEL32(00000000,?), ref: 00661031
Process32Next.KERNEL32(00000000,?), ref: 00661103
CloseHandle.KERNEL32(00000000), ref: 00661112
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 00661486
RegEnumKeyExA.KERNELBASE(?,00000000,?,?), ref: 006614BD
wsprintfA.USER32 ref: 006615A0
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 006615C3
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400), ref: 006616C2
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400), ref: 006617B9
RegCloseKey.ADVAPI32(?), ref: 00661895
RegCloseKey.ADVAPI32(?), ref: 006618B0

Strings

4oST, xrefs: 0066153D
1.9, xrefs: 0065DD77, 0065DE08
4oST, xrefs: 0065FDDC
4oST, xrefs: 00660D13
dilda, xrefs: 0065DCD4, 0065DD5E
4oST, xrefs: 0066174E
POpq, xrefs: 00660C75
4oST, xrefs: 0065FF1A
4oST, xrefs: 0066134F
6hR, xrefs: 0065F98E
3"Y, xrefs: 0065D376, 0065DA40, 0065D524, 0065D529, 0065D533
z,^, xrefs: 006609E2
4oST, xrefs: 006619DB
4oST, xrefs: 006614F7
4oST, xrefs: 00661657
>oST, xrefs: 006617F3

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: CloseTime$FileOpenQueryValue$LocalNameSystem$FindNextProcess32$CreateCurrentErrorFirstHandleInfoKeyboardLastLayoutListLocaleModuleProcessUserWindow$AllocComputerCopyDefaultDesktopDirectoryEnumFreeGlobalInformationMemoryProfileRectSnapshotSpecificStatusToolhelp32Unothrow_t@std@@@Wow64Zone__ehfuncinfo$??2@wsprintf
String ID: 1.9$3"Y$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$6hR$>oST$POpq$dilda$z,^
API String ID: 2403077049-527788428
Opcode ID: 4a818bb3ac5efbdae14ca243ad003091a3cc68c55ed9b3c5b4c268b6a4b0e71e
Instruction ID: bbe44f2556c0bb19008284e146c3ec08fd0a579ce1a9709dd165086825fc9203
Opcode Fuzzy Hash: 4a818bb3ac5efbdae14ca243ad003091a3cc68c55ed9b3c5b4c268b6a4b0e71e
Instruction Fuzzy Hash: 5EB3DFB4D05259CFDB25CF98C991AEEBBB1BF48300F244199E909B7341DB306A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0058B8E0 Relevance: 105.6, APIs: 40, Strings: 17, Instructions: 5855fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058BA08
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058BAD2
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0058BF80
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0058C47A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058C575
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0058C969
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0058CD72
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0058D17B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058D29A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058D6F8
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0058D9DC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058DAD7
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0058DE41
CopyFileA.KERNEL32(?,?,00000000), ref: 0058E55A
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0058ECF6
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0058EEEA
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058F45B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058F525
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 005901ED
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00590580
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0059088D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00590DC4
CopyFileA.KERNEL32(?,?,00000000), ref: 0059173C
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00591904
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00591CD7
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00591E6E
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00591FBE
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00590B14

Part of subcall function 0065D2B0: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,006E2B0C,00000001,0000002E,0000002F,?,006D83D1,3"Y,006D83D1), ref: 0065D78B

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00590F12
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058FEF1

Part of subcall function 00663B20: GetLastError.KERNEL32 ref: 00663ED0

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058FC55

Part of subcall function 0065D2B0: FindFirstFileA.KERNEL32(00000000,?), ref: 0065D4BB

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058F933

Part of subcall function 00663B20: SetFileAttributesA.KERNEL32(?,00000080,?,?,007064F8,?,?), ref: 00663E3A
Part of subcall function 00663B20: DeleteFileA.KERNEL32(?), ref: 00663E54
Part of subcall function 00663B20: RemoveDirectoryA.KERNELBASE(?), ref: 00663EBB
Part of subcall function 00663B20: std::_Throw_Cpp_error.LIBCPMT ref: 00663F97
Part of subcall function 00663B20: std::_Throw_Cpp_error.LIBCPMT ref: 00663FA8

Part of subcall function 00664050: std::_Throw_Cpp_error.LIBCPMT ref: 006640FF
Part of subcall function 00664050: std::_Throw_Cpp_error.LIBCPMT ref: 00664110

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058E6FA

Part of subcall function 006433B0: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 006434EF

Part of subcall function 005A9070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 005A910D
Part of subcall function 005A9070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 005A9155

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058DF3C

Part of subcall function 00663B20: FindNextFileA.KERNELBASE(?,00000010), ref: 00663E68
Part of subcall function 00663B20: FindClose.KERNEL32(?), ref: 00663E7A
Part of subcall function 00663B20: GetLastError.KERNEL32 ref: 00663E80
Part of subcall function 00663B20: SetFileAttributesA.KERNELBASE(?,00000080), ref: 00663E9D

CopyFileA.KERNEL32(?,00000000,00000000), ref: 0058D5FD

Part of subcall function 00663B20: FindFirstFileA.KERNELBASE(00000000,?,007064F8,?,?,?,\*.*,00000004), ref: 00663C95

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0058BB07

Part of subcall function 00664050: GetFileAttributesA.KERNELBASE(?,?,00000006,00000005,00000005), ref: 006640AC
Part of subcall function 00664050: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 006640B7

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058BD08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0058BD37
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058C0CC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058C196

Strings

4oST, xrefs: 0058E34C
.eN, xrefs: 0058DF4F
4oST, xrefs: 0058E1F8
4oST, xrefs: 0058E244
4oST, xrefs: 0058E040
<`L, xrefs: 00590D0A
4oST, xrefs: 0058E414
4oST, xrefs: 005914A0
4oST, xrefs: 00592177
4oST, xrefs: 005912C8
4oST, xrefs: 005915AE
4oST, xrefs: 005914EC
4oST, xrefs: 00591390
4oST, xrefs: 005913DC
4oST, xrefs: 00591016
4oST, xrefs: 0058E300
4oST, xrefs: 0059127C

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: Directory$Create$File$Copy$Find$Cpp_errorThrow_std::_$AttributesErrorFirstLast$FolderPath___std_fs_convert_narrow_to_wide@20$CloseDeleteNextRemove
String ID: .eN$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$<`L
API String ID: 1172780710-464024716
Opcode ID: 72161b76f1b7c0519de6505ec3708586e4a0807f4090364b843370886433543f
Instruction ID: 80083db2b6f921f799843b54d5f0f24ac98491387d45c51573a8f95ffd2836a4
Opcode Fuzzy Hash: 72161b76f1b7c0519de6505ec3708586e4a0807f4090364b843370886433543f
Instruction Fuzzy Hash: E5F3DEB4D052998FDF25CF98C991AEEBBB1BF48300F104199E849B7341DB346A85CF66

Uniqueness

Uniqueness Score: -1.00%

Function 005FF730 Relevance: 105.5, APIs: 7, Strings: 52, Instructions: 2202COMMON

Download Yara Rule

APIs

Part of subcall function 00664050: GetFileAttributesA.KERNELBASE(?,?,00000006,00000005,00000005), ref: 006640AC
Part of subcall function 00664050: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 006640B7

SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?), ref: 006002CB
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,?,?,?,?), ref: 006005C7
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 006008C5
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00600C25
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00600F53
SHGetFolderPathA.SHELL32(00000000,00000008,00000000,00000000,?), ref: 00601257
Concurrency::cancel_current_task.LIBCPMT ref: 00602001

Strings

4oST, xrefs: 0060151C
4oST, xrefs: 005FF988
4oST, xrefs: 006030E0
4oST, xrefs: 006012CF
4oST, xrefs: 006022BE
4oST, xrefs: 00601A2B
4oST, xrefs: 00602963
type must be boolean, but is , xrefs: 00602027
4oST, xrefs: 0060241F
type must be string, but is , xrefs: 0060207B
4oST, xrefs: 006017CE
4oST, xrefs: 00602B9C
4oST, xrefs: 00602BE8
4oST, xrefs: 00600CED
4oST, xrefs: 00602310
4oST, xrefs: 0060191C
4oST, xrefs: 00601166
4oST, xrefs: 005FF8A3
4oST, xrefs: 005FFE93
4oST, xrefs: 005FFA6D
`<vT, xrefs: 0060063F
4oST, xrefs: 006029AF
4oST, xrefs: 0060181A
4oST, xrefs: 0060101B
4oST, xrefs: 0060068B
4oST, xrefs: 00602817
cannot compare iterators of different containers, xrefs: 00601FBD
P!T, xrefs: 005FFA1B
4oST, xrefs: 0060021B
4oST, xrefs: 0060167B
4oST, xrefs: 006011B2
4oST, xrefs: 005FFB4F
4oST, xrefs: 006027CB
4oST, xrefs: 006019DF
4oST, xrefs: 006023D3
X0 , xrefs: 005FFC98
4oST, xrefs: 0060312C
4oST, xrefs: 00600522
`<vT, xrefs: 006004D6
4oST, xrefs: 006018D0
4oST, xrefs: 0060098B
4oST, xrefs: 005FFD3C
Q086, xrefs: 005FFAFD
4oST, xrefs: 005FFE47
4oST, xrefs: 00600EA8
4oST, xrefs: 00600B79
4oST, xrefs: 0060038F
4oST, xrefs: 0060131B
4oST, xrefs: 00601568
4oST, xrefs: 0060081A
4oST, xrefs: 0060162F
cannot get value, xrefs: 00601F7E, 006020B8

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: FolderPath$AttributesConcurrency::cancel_current_taskErrorFileLast
String ID: 4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$P!T$Q086$X0 $`<vT$`<vT$cannot compare iterators of different containers$cannot get value$type must be boolean, but is $type must be string, but is
API String ID: 1974481932-3377599526
Opcode ID: 3d5b54080cac3e088c81dc463ab04708ac1dbafcb9719237c8613a17e4e5f433
Instruction ID: f5770b06accf226b86d4b7ce063d33fee86a703afbe88ce7aef7590a9d04db71
Opcode Fuzzy Hash: 3d5b54080cac3e088c81dc463ab04708ac1dbafcb9719237c8613a17e4e5f433
Instruction Fuzzy Hash: FF43F1B4D052698BDB25CF24C894BEEBBB5BF49304F1082D9E849A7281DB316F85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 006161D0 Relevance: 91.4, APIs: 4, Strings: 47, Instructions: 2129stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00616324
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00616422
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00616618
lstrlen.KERNEL32(?), ref: 00618931

Strings

4oST, xrefs: 006163A3
4oST, xrefs: 00617AA9
4oST, xrefs: 006170CC
4oST, xrefs: 00616868
4oST, xrefs: 00616AA8
4oST, xrefs: 006177EF
4oST, xrefs: 0061681C
4oST, xrefs: 006164B2
nI?/, xrefs: 00617054
4oST, xrefs: 00616460
4oST, xrefs: 00618547
4oST, xrefs: 00616CB4
4oST, xrefs: 00617CC2
cannot use push_back() with , xrefs: 00618851, 006189DA
g[}, xrefs: 00616C30
4oST, xrefs: 0061664A
K@z, xrefs: 00617A7D
4oST, xrefs: 00617C76
x<, xrefs: 00617210
4oST, xrefs: 00617417
4oST, xrefs: 006183A5
4oST, xrefs: 006187E5
4oST, xrefs: 00618359
4oST, xrefs: 00618151
UYw, xrefs: 0061832D
4oST, xrefs: 00617E46
4oST, xrefs: 0061761D
cannot use operator[] with a string argument with , xrefs: 006189A3, 00618A39
MXg, xrefs: 0061851B
4oST, xrefs: 00618793
_Ys, xrefs: 0061739F
4oST, xrefs: 00616D92
4oST, xrefs: 00616A5C
4oST, xrefs: 006177A3
4oST, xrefs: 00616D40
4oST, xrefs: 00616696
4oST, xrefs: 00617AF5
k@z, xrefs: 0061653C
4oST, xrefs: 006165BB
#iR@, xrefs: 00617206
4oST, xrefs: 00617E92
4oST, xrefs: 00618593
4oST, xrefs: 006173CB
X[y, xrefs: 00618764
4oST, xrefs: 006175D1
4oST, xrefs: 00616568
HWg, xrefs: 00617E1A

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: #iR@$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$HWg$K@z$MXg$UYw$X[y$_Ys$cannot use operator[] with a string argument with $cannot use push_back() with $g[}$k@z$nI?/$x<
API String ID: 1311570089-1367517158
Opcode ID: 0d82be3a0585a6ba21878471336d0ce559e948ce5ca3cc5ba117c6da7033679e
Instruction ID: 4fb4c059bc76277563b802165290e5da9a3163b4165eb38ed27c0b35737bc05a
Opcode Fuzzy Hash: 0d82be3a0585a6ba21878471336d0ce559e948ce5ca3cc5ba117c6da7033679e
Instruction Fuzzy Hash: 9B4311B0D052A98FDB25CF28C894BEEBBB1BF49304F1481D9E449A7242DB316B85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00611A60 Relevance: 79.0, APIs: 11, Strings: 33, Instructions: 1966fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00611AC7

Part of subcall function 00664050: GetFileAttributesA.KERNELBASE(?,?,00000006,00000005,00000005), ref: 006640AC
Part of subcall function 00664050: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 006640B7

FindFirstFileA.KERNEL32(?,?), ref: 0061207F
FindNextFileA.KERNEL32(00000000,?), ref: 0061248C
FindClose.KERNEL32(00000000), ref: 0061249C
CreateDirectoryA.KERNEL32(?,00000000), ref: 00612573
CreateDirectoryA.KERNEL32(?,00000000), ref: 00612639
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 006127BD

Part of subcall function 00664050: std::_Throw_Cpp_error.LIBCPMT ref: 006640FF
Part of subcall function 00664050: std::_Throw_Cpp_error.LIBCPMT ref: 00664110

CreateDirectoryA.KERNEL32(?,00000000), ref: 00612964
CopyFileA.KERNEL32(00000000,?,00000000), ref: 00612C18
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00613158
CredEnumerateA.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?), ref: 0061351D

Part of subcall function 005B51EB: RaiseException.KERNEL32(E06D7363,00000001,00000003,0059ABA8,?,?,?,005B1CF9,0059ABA8,006F69D8,00000000,0059ABA8), ref: 005B524B

Strings

4oST, xrefs: 00613C77
4oST, xrefs: 0061299C
4oST, xrefs: 00613A2C
4oST, xrefs: 00613386
4oST, xrefs: 00613CC3
WS{, xrefs: 00613C4B
4oST, xrefs: 00613686
KGa, xrefs: 00613B39
4oST, xrefs: 00613BB7
4oST, xrefs: 00612DB4
4oST, xrefs: 00612AAA
4oST, xrefs: 00613B65
4oST, xrefs: 00612FE2
4oST, xrefs: 0061285E
cannot use operator[] with a string argument with , xrefs: 00613E34, 00613E8E
4oST, xrefs: 00612B28
4oST, xrefs: 00612E96
4oST, xrefs: 006138F0
gUb, xrefs: 00612A38
4oST, xrefs: 006129D6
4oST, xrefs: 006128B0
4oST, xrefs: 006139DA
WS{, xrefs: 006139AE
4oST, xrefs: 0061389E
4oST, xrefs: 006130B2
4oST, xrefs: 006136D2
4oST, xrefs: 00612150
4oST, xrefs: 00612F96
gUb, xrefs: 0061296A
4oST, xrefs: 00612EE8
4oST, xrefs: 00612A5E
4oST, xrefs: 0061275D
4oST, xrefs: 006120CA

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: File$CopyCreateDirectoryFind$Cpp_errorThrow_std::_$AttributesCloseCredEnumerateErrorExceptionFirstFolderLastNextPathRaise
String ID: 4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$KGa$WS{$WS{$cannot use operator[] with a string argument with $gUb$gUb
API String ID: 2195218309-977541193
Opcode ID: 2b2067fc32167323a146f678440e724d9124b7f8e1a82a57374668589bee6e37
Instruction ID: 6a2795993949ad8cd3d0df85cabd1456da09c6966685320fa05597747bc7d70f
Opcode Fuzzy Hash: 2b2067fc32167323a146f678440e724d9124b7f8e1a82a57374668589bee6e37
Instruction Fuzzy Hash: 4A33ECB4D052A98BDB25CF68C994BEDBBB1BF48300F1481DAE849A7341DB306B85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00618A80 Relevance: 75.4, APIs: 4, Strings: 38, Instructions: 1876stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00618C78
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00618D85
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00618F78
lstrlen.KERNEL32(?), ref: 0061AD4D

Strings

4oST, xrefs: 00619EA9
Gr}, xrefs: 006199B4
4oST, xrefs: 0061A34F
4oST, xrefs: 0061A556
4oST, xrefs: 00618E12
4oST, xrefs: 0061A209
4oST, xrefs: 00619408
4oST, xrefs: 00618EC8
4oST, xrefs: 0061917C
4oST, xrefs: 00618F1B
]Xw, xrefs: 0061A2D7
4oST, xrefs: 00619CAB
cannot use push_back() with , xrefs: 0061AC0A, 0061AE0C
4oST, xrefs: 006191C8
]Xw, xrefs: 0061A1DD
4oST, xrefs: 00619614
x<, xrefs: 00619B70
k@z, xrefs: 00618E9C
4oST, xrefs: 0061A7C3
K@z, xrefs: 0061A797
4oST, xrefs: 00618CFA
#iR@, xrefs: 00619B66
4oST, xrefs: 0061A255
9lX, xrefs: 006195A0
cannot use operator[] with a string argument with , xrefs: 0061ADBC, 0061AE73
4oST, xrefs: 00618FF6
4oST, xrefs: 00618DC0
4oST, xrefs: 0061A80F
4oST, xrefs: 0061A303
4oST, xrefs: 00618FAA
4oST, xrefs: 006196F2
4oST, xrefs: 006193BC
4oST, xrefs: 0061AB1F
4oST, xrefs: 006196A0
4oST, xrefs: 0061A5A2
4oST, xrefs: 00619CFA
_C|, xrefs: 0061AA4C
4oST, xrefs: 00619A2C

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: #iR@$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$9lX$Gr}$K@z$]Xw$]Xw$_C|$cannot use operator[] with a string argument with $cannot use push_back() with $k@z$x<
API String ID: 1311570089-653804416
Opcode ID: 4657777a86a8c0f48528722f8c33926ab4cc40e7bd1e56838aa62ca66e049ddc
Instruction ID: 0eb9c2e5e389fc51b63ca9f35ebc25393bfe469b4053c76caa44a45b6e2bcffa
Opcode Fuzzy Hash: 4657777a86a8c0f48528722f8c33926ab4cc40e7bd1e56838aa62ca66e049ddc
Instruction Fuzzy Hash: 79231FB0D052698BDB25CF68C894BEDBBB1BF49304F1482D9E849A7281DB306BC5CF55

Uniqueness

Uniqueness Score: -1.00%

Function 006549B0 Relevance: 67.6, APIs: 31, Strings: 4, Instructions: 6337fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,006D80C7,000000FF), ref: 00654A1C
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00654A43
CreateDirectoryA.KERNEL32(?,00000000), ref: 00654D09
CreateDirectoryA.KERNEL32(?,00000000), ref: 0065506B
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006561A7
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00656D42
CreateDirectoryA.KERNEL32(?,00000000), ref: 006576CE
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0065779F
CreateDirectoryA.KERNEL32(?,00000000), ref: 00657AC2
CreateDirectoryA.KERNEL32(?,00000000), ref: 00657E2D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00657EFE
CreateDirectoryA.KERNEL32(?,00000000), ref: 006581E9
CreateDirectoryA.KERNEL32(?,00000000,?,?,?), ref: 00658479
CreateDirectoryA.KERNEL32(?,00000000), ref: 0065862C
CreateDirectoryA.KERNEL32(?,00000000), ref: 00658906
CreateDirectoryA.KERNEL32(?,00000000), ref: 00658CEC
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?), ref: 006590A1
CreateDirectoryA.KERNEL32(?,00000000), ref: 00659254
CreateDirectoryA.KERNEL32(?,00000000), ref: 0065952E
CreateDirectoryA.KERNEL32(?,00000000), ref: 00659914
CreateDirectoryA.KERNEL32(?,00000000), ref: 00657363

Part of subcall function 0065D2B0: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0065D906
Part of subcall function 0065D2B0: GetLastError.KERNEL32 ref: 0065D950

CreateDirectoryA.KERNEL32(?,00000000), ref: 00659D4C
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00659EA3

Part of subcall function 0065B7E0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0065B84D

CreateDirectoryA.KERNEL32(?,00000000), ref: 00657003

Part of subcall function 00663B20: SetFileAttributesA.KERNEL32(?,00000080,?,?,007064F8,?,?), ref: 00663E3A
Part of subcall function 00663B20: DeleteFileA.KERNEL32(?), ref: 00663E54
Part of subcall function 00663B20: RemoveDirectoryA.KERNELBASE(?), ref: 00663EBB
Part of subcall function 00663B20: std::_Throw_Cpp_error.LIBCPMT ref: 00663F97
Part of subcall function 00663B20: std::_Throw_Cpp_error.LIBCPMT ref: 00663FA8

Part of subcall function 00663B20: GetLastError.KERNEL32 ref: 00663ED0

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 006569F8

Part of subcall function 0065D2B0: FindNextFileA.KERNEL32(00000000,?), ref: 0065D91C
Part of subcall function 0065D2B0: FindClose.KERNEL32(00000000), ref: 0065D92C
Part of subcall function 0065D2B0: GetLastError.KERNEL32 ref: 0065D932

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0065658D

Part of subcall function 00663B20: FindNextFileA.KERNELBASE(?,00000010), ref: 00663E68
Part of subcall function 00663B20: FindClose.KERNEL32(?), ref: 00663E7A
Part of subcall function 00663B20: GetLastError.KERNEL32 ref: 00663E80
Part of subcall function 00663B20: SetFileAttributesA.KERNELBASE(?,00000080), ref: 00663E9D

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 00655D1A

Part of subcall function 0065D2B0: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,006E2B0C,00000001,0000002E,0000002F,?,006D83D1,3"Y,006D83D1), ref: 0065D78B

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00655ECD
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?), ref: 00655712

Part of subcall function 00663B20: FindFirstFileA.KERNELBASE(00000000,?,007064F8,?,?,?,\*.*,00000004), ref: 00663C95

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 006559D3
CreateDirectoryA.KERNEL32(?,00000000), ref: 006553CB

Part of subcall function 0065D2B0: FindFirstFileA.KERNEL32(00000000,?), ref: 0065D4BB

Part of subcall function 00664050: GetFileAttributesA.KERNELBASE(?,?,00000006,00000005,00000005), ref: 006640AC
Part of subcall function 00664050: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 006640B7

Part of subcall function 00664050: std::_Throw_Cpp_error.LIBCPMT ref: 006640FF
Part of subcall function 00664050: std::_Throw_Cpp_error.LIBCPMT ref: 00664110

Strings

=lY, xrefs: 00658FD5
4oST, xrefs: 0065A158
g], xrefs: 00659F17, 00659FFE, 0065A0EA, 0065A1D1, 0065A28F, 0065A37A, 0065A461, 0065A54A, 0065A631, 0065A71A, 0065A801, 0065A8EA, 0065A9D1, 0065AABA, 0065ABA1, 00659C7D, 00658FD2, 006583AA, 0065811A, 00657D5E, 006579F3, 006575FF, 00657294, 00656F34, 00656C73, 00656929, 00655C4B, 00655904, 00655643, 006552FC, 00654F9C, 00654C3A, 00659F1F, 0065A006, 0065A0F2, 0065A1D9, 0065A297, 0065A382, 0065A469, 0065A552, 0065A639, 0065A722, 0065A809, 0065A8F2, 0065A9D9, 0065AAC2, 0065ABA9
4oST, xrefs: 0065B484

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: Directory$Create$File$Find$ErrorLast$CopyCpp_errorThrow_std::_$AttributesFolderPath$CloseFirstNext$DeleteRemove
String ID: 4oST$4oST$=lY$g]
API String ID: 1140557632-3277889653
Opcode ID: b73628a24ec499fb7cc1bc7aaf613f21137309e62a5e6f0b7996782f7105219b
Instruction ID: 3e09a050e3610031276a354a6d72712fb6f306d7ce342ee513dc3962ba33a218
Opcode Fuzzy Hash: b73628a24ec499fb7cc1bc7aaf613f21137309e62a5e6f0b7996782f7105219b
Instruction Fuzzy Hash: DDF3F2B4C0529A8FCB15CFA8C991AEEBBB1BF48304F244199D94977341DB305B85CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0061AEC0 Relevance: 64.6, APIs: 4, Strings: 32, Instructions: 1570stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0061B014
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0061B112
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0061B305
lstrlen.KERNEL32(?), ref: 0061CA52

Strings

MXg, xrefs: 0061C561
4oST, xrefs: 0061BFBF
4oST, xrefs: 0061B255
k@z, xrefs: 0061B229
4oST, xrefs: 0061B75C
4oST, xrefs: 0061B7A8
g[`, xrefs: 0061B943
4oST, xrefs: 0061B337
4oST, xrefs: 0061B558
4oST, xrefs: 0061B2A8
cannot use push_back() with , xrefs: 0061C996, 0061CB4B
4oST, xrefs: 0061C2FE
4oST, xrefs: 0061C0EE
4oST, xrefs: 0061BB18
4oST, xrefs: 0061B093
4oST, xrefs: 0061B14D
cannot use operator[] with a string argument with , xrefs: 0061CABD, 0061CAFB, 0061CBAD
4oST, xrefs: 0061BDF4
]?0, xrefs: 0061BCF8
UYw, xrefs: 0061C2D2
4oST, xrefs: 0061C5D9
4oST, xrefs: 0061B50C
4oST, xrefs: 0061BA19
4oST, xrefs: 0061B383
4oST, xrefs: 0061C34A
4oST, xrefs: 0061C842
4oST, xrefs: 0061B19F
4oST, xrefs: 0061C09C
4oST, xrefs: 0061C7F6
4oST, xrefs: 0061C58D
4oST, xrefs: 0061C011
4oST, xrefs: 0061BB70

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: 4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$MXg$UYw$]?0$cannot use operator[] with a string argument with $cannot use push_back() with $g[`$k@z
API String ID: 1311570089-684522203
Opcode ID: a2f55afe79dd8ef61dca33f3206eb1eb70b9d8dd3af8a7a8f0e2da2ffb91e69f
Instruction ID: b04b57f671f44c6796e0a52843bb4133dfb987701f214a954563dbbc091a8bff
Opcode Fuzzy Hash: a2f55afe79dd8ef61dca33f3206eb1eb70b9d8dd3af8a7a8f0e2da2ffb91e69f
Instruction Fuzzy Hash: 130321B0D052698FDB25CF28C894BEDBBB5BF48304F1482D9E849A7242DB306B85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00663B20 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 334
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,007064F8,?,?,?,\*.*,00000004), ref: 00663C95
SetFileAttributesA.KERNEL32(?,00000080,?,?,007064F8,?,?), ref: 00663E3A
DeleteFileA.KERNEL32(?), ref: 00663E54
FindNextFileA.KERNELBASE(?,00000010), ref: 00663E68
FindClose.KERNEL32(?), ref: 00663E7A
GetLastError.KERNEL32 ref: 00663E80
SetFileAttributesA.KERNELBASE(?,00000080), ref: 00663E9D
RemoveDirectoryA.KERNELBASE(?), ref: 00663EBB
GetLastError.KERNEL32 ref: 00663ED0
std::_Throw_Cpp_error.LIBCPMT ref: 00663F97
std::_Throw_Cpp_error.LIBCPMT ref: 00663FA8

Strings

\*.*, xrefs: 00663BE4

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: File$Find$AttributesCpp_errorErrorLastThrow_std::_$CloseDeleteDirectoryFirstNextRemove
String ID: \*.*
API String ID: 460640838-1173974218
Opcode ID: 0dcfb96019f4d98dd717d60e6269e5af8535f8cb885d8a5116213d0dd39f17a6
Instruction ID: f360367f1eabd99a623352323ab2163923290f430b125d5cc07b75a5a8c1f546
Opcode Fuzzy Hash: 0dcfb96019f4d98dd717d60e6269e5af8535f8cb885d8a5116213d0dd39f17a6
Instruction Fuzzy Hash: CDD1EE70D01259CFDB10DFA8C9487EDBBB2BF81304F248259E454AB392D7719B89CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0065B7E0 Relevance: 14.7, APIs: 5, Strings: 3, Instructions: 731
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0065B84D

Part of subcall function 00664050: GetFileAttributesA.KERNELBASE(?,?,00000006,00000005,00000005), ref: 006640AC
Part of subcall function 00664050: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 006640B7

Part of subcall function 00664050: std::_Throw_Cpp_error.LIBCPMT ref: 006640FF
Part of subcall function 00664050: std::_Throw_Cpp_error.LIBCPMT ref: 00664110

CreateDirectoryA.KERNEL32(?,00000000), ref: 0065BC79
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0065BE33
CreateDirectoryA.KERNEL32(?,00000000), ref: 0065C0C1
CreateDirectoryA.KERNEL32(?,00000000), ref: 0065C217

Strings

4oST, xrefs: 0065C123
4oST, xrefs: 0065C29A
6l_, xrefs: 0065BD3D

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesCopyErrorFolderLastPath
String ID: 4oST$4oST$6l_
API String ID: 1001086254-652797657
Opcode ID: 604b529fcb6134c6d2348e6fa9ea2ccf311b5b18e8eb01f260449b1b4e34aadb
Instruction ID: 76f33c134a4bdd8fb95711094e62210876d61ed69dfe517ea615aa765d18642c
Opcode Fuzzy Hash: 604b529fcb6134c6d2348e6fa9ea2ccf311b5b18e8eb01f260449b1b4e34aadb
Instruction Fuzzy Hash: 008225B4C0525ACFDB15CFA4C995BEEBBB1BF58300F204199D949B7241DB305A85CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0065C3E0 Relevance: 13.1, APIs: 5, Strings: 2, Instructions: 876
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0065C44A
CreateDirectoryA.KERNEL32(?,00000000), ref: 0065C6D9

Part of subcall function 00664050: GetFileAttributesA.KERNELBASE(?,?,00000006,00000005,00000005), ref: 006640AC
Part of subcall function 00664050: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 006640B7

CreateDirectoryA.KERNEL32(?,00000000), ref: 0065C8DA
CreateDirectoryA.KERNEL32(?,00000000), ref: 0065CBFA

Part of subcall function 00664050: std::_Throw_Cpp_error.LIBCPMT ref: 006640FF
Part of subcall function 00664050: std::_Throw_Cpp_error.LIBCPMT ref: 00664110

CreateDirectoryA.KERNEL32(?,00000000), ref: 0065D02D

Part of subcall function 00663B20: FindFirstFileA.KERNELBASE(00000000,?,007064F8,?,?,?,\*.*,00000004), ref: 00663C95

Strings

4oST, xrefs: 0065D0F9
4oST, xrefs: 0065C85E

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesErrorFindFirstFolderLastPath
String ID: 4oST$4oST
API String ID: 2127212259-3962470393
Opcode ID: 514e7389c325c253521f5e668791310fc33f242d6ae2566c4b90a3de149ba9b4
Instruction ID: 37f2b6d91b38ddcac9735d30aa0a64092d98ba9747636895b3c4e218a8ebfece
Opcode Fuzzy Hash: 514e7389c325c253521f5e668791310fc33f242d6ae2566c4b90a3de149ba9b4
Instruction Fuzzy Hash: EAA2FFB4C05259CFDB25CFA8C991AEEBBB1BF48300F244199D949B7341DB305A85CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00644130 Relevance: 12.8, APIs: 3, Strings: 4, Instructions: 535
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00644401

Part of subcall function 005B2524: __EH_prolog3.LIBCMT ref: 005B2560

std::_Throw_Cpp_error.LIBCPMT ref: 00644412

Part of subcall function 00664870: __fread_nolock.LIBCMT ref: 006649B9

DeleteFileA.KERNELBASE(?), ref: 0064449B

Strings

4oST, xrefs: 00644239
131, xrefs: 006444E5, 006444FE
dilda, xrefs: 00644521, 0064453A
4oST, xrefs: 0064477D

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$DeleteFileH_prolog3__fread_nolock
String ID: 131$4oST$4oST$dilda
API String ID: 3880692912-3745965330
Opcode ID: 5ac991f4b1a2a054fc7042bb7f371b90d0b9d9d6aa4007d89621e10d26c655c0
Instruction ID: a3abd8446cd1a994293047cc1438d1980a505f48af5096a157640fd2ab377f9a
Opcode Fuzzy Hash: 5ac991f4b1a2a054fc7042bb7f371b90d0b9d9d6aa4007d89621e10d26c655c0
Instruction Fuzzy Hash: 36328DB4D00249DFCB05DF98C855BEEBBB2FF48304F248159E8056B392DB35AA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 006433B0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 006434EF
FindNextFileA.KERNELBASE(00000000,00000010), ref: 006437EF
GetLastError.KERNEL32 ref: 006437FD
FindClose.KERNEL32(00000000), ref: 0064380D

Strings

4oST, xrefs: 00643494
4oST, xrefs: 006435E6
4oST, xrefs: 006435A0

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID: 4oST$4oST$4oST
API String ID: 819619735-2236699556
Opcode ID: 7d23ebbb41c4012b46dd0ea307fbfc50da99c12342bada66fe4811e03d8408c2
Instruction ID: 8c794a52fcaee2544d1cfd6668d3e8e4255bd4aabbab28b8cc2d1f36045e962a
Opcode Fuzzy Hash: 7d23ebbb41c4012b46dd0ea307fbfc50da99c12342bada66fe4811e03d8408c2
Instruction Fuzzy Hash: 83D18AB0C002998FDB25CF98C9947EEBBB2BF45314F244299E449AB382D7746A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00678080 Relevance: 10.5, Strings: 8, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

RTRIM, xrefs: 006782E8
no such vfs: %s, xrefs: 00678237
sqlite_rename_table, xrefs: 00678464
BINARY, xrefs: 006782A5, 006782B4, 006782CE, 0067830E, 00678319, 00678331, 00678383, 00678384
MATCH, xrefs: 00678488, 00678499, 006784B9, 006784BA, 006784D0
@xl, xrefs: 0067814B, 0067854F
NOCASE, xrefs: 006783AA
automatic extension loading failed: %s, xrefs: 006785AC

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @xl$BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
API String ID: 0-1902741935
Opcode ID: 82e5de6bf820d6904c0432cedc5e3e5060917d91e91194e1a0f00e54f3fc0706
Instruction ID: ff4f224b9ab187b761bd4f10c35820af2e888f8b699fa870a5e6cb3d4890e56e
Opcode Fuzzy Hash: 82e5de6bf820d6904c0432cedc5e3e5060917d91e91194e1a0f00e54f3fc0706
Instruction Fuzzy Hash: 22021670A40700AFEB209F25DC49BAB77E6AB40304F14852CE54E9B392DFB5EE45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 006452A0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 399COMMON

Download Yara Rule

Strings

4oST, xrefs: 0064552A
4oST, xrefs: 00645451
4oST, xrefs: 006455B5

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4oST$4oST$4oST
API String ID: 0-2236699556
Opcode ID: 8cebb4a56691aef6a06756bd01d746ef974c2458856f266c19707b1393196d8e
Instruction ID: 30cf764a842a67aee4d12f334ae4b8aed366a95f93d2021278125a13d90f0582
Opcode Fuzzy Hash: 8cebb4a56691aef6a06756bd01d746ef974c2458856f266c19707b1393196d8e
Instruction Fuzzy Hash: 8D02DF70D04258DFDF14EFA8C9457DDBFB1AB84304F148199E8056B382DBB55E48DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 006BC8D0 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006BCA85
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006BCD87

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: be1a6da59457d9c21f204e53b49ecdb764926aa479f85a94437f7d6e2eaff229
Instruction ID: 4899c4a3801e4b811ed644c25016158edf7230bdb336b9f0da304d6040406fbc
Opcode Fuzzy Hash: be1a6da59457d9c21f204e53b49ecdb764926aa479f85a94437f7d6e2eaff229
Instruction Fuzzy Hash: 66029FB0604602AFDB64CF28C850BEAB7E6BF88324F04866DE459C7750D775EE95CB81

Uniqueness

Uniqueness Score: -1.00%

Function 005C001D Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bb5bd4292d8a785e4399c711df7bbe85bf159ea8c45ac5dd6bb28b0f1b91103
Instruction ID: 25031f06bea21e76ecd98d0f5fb2a42f9e4ab85f9b4e510f502a1445046f88fc
Opcode Fuzzy Hash: 2bb5bd4292d8a785e4399c711df7bbe85bf159ea8c45ac5dd6bb28b0f1b91103
Instruction Fuzzy Hash: 03B1C07490060ACFCF288EE8C959FBEBFB1BB44710F186A1DD852A76D1C634AA41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 005E3650 Relevance: 149.4, APIs: 3, Strings: 81, Instructions: 2365COMMON

Download Yara Rule

APIs

Part of subcall function 00664050: GetFileAttributesA.KERNELBASE(?,?,00000006,00000005,00000005), ref: 006640AC
Part of subcall function 00664050: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 006640B7

Part of subcall function 00663FC0: CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 00664005

CreateDirectoryA.KERNELBASE(?,00000000), ref: 005E5AD0
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 005E5DF5

Part of subcall function 00664050: std::_Throw_Cpp_error.LIBCPMT ref: 006640FF
Part of subcall function 00664050: std::_Throw_Cpp_error.LIBCPMT ref: 00664110

CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 005E5CE6

Strings

4oST, xrefs: 005E6033
4oST, xrefs: 005E5F16
4oST, xrefs: 005E4CA7
UYw, xrefs: 005E4243
4oST, xrefs: 005E4489
_Ys, xrefs: 005E506E
K@z, xrefs: 005E5161
HFd, xrefs: 005E6240
4oST, xrefs: 005E3F8F
4oST, xrefs: 005E626C
HWg, xrefs: 005E445D
4oST, xrefs: 005E537A
4oST, xrefs: 005E509A
UYw, xrefs: 005E42BE
4oST, xrefs: 005E5112
4oST, xrefs: 005E546D
4oST, xrefs: 005E5F88
K@z, xrefs: 005E50E6
4oST, xrefs: 005E43DD
4oST, xrefs: 005E3C78
=J ], xrefs: 005E57CF
4oST, xrefs: 005E40FD
UYw, xrefs: 005E52D3
4oST, xrefs: 005E5674
4oST, xrefs: 005E56EB
4oST, xrefs: 005E3E4D
4oST, xrefs: 005E52FF
K@z, xrefs: 005E4056
O_w, xrefs: 005E63AE
4oST, xrefs: 005E4EE2
4oST, xrefs: 005E501F
=J ], xrefs: 005E473F
4oST, xrefs: 005E400A
4oST, xrefs: 005E46C0
MXg, xrefs: 005E43B1
4oST, xrefs: 005E55F5
HWg, xrefs: 005E54ED
4oST, xrefs: 005E426F
4oST, xrefs: 005E5590
4oST, xrefs: 005E5519
4oST, xrefs: 005E3A9B
4oST, xrefs: 005E518D
4oST, xrefs: 005E45E4
4oST, xrefs: 005E4D19
4oST, xrefs: 005E663D
4oST, xrefs: 005E67E8
4oST, xrefs: 005E4362
4oST, xrefs: 005E4B38
4oST, xrefs: 005E63DA
4oST, xrefs: 005E5C36
4oST, xrefs: 005E4082
4oST, xrefs: 005E3741
GoST, xrefs: 005E59DC
_Ys, xrefs: 005E3F63
MXg, xrefs: 005E5441
4oST, xrefs: 005E3990
4oST, xrefs: 005E42EA
UYw, xrefs: 005E534E
MXg, xrefs: 005E53C6
4oST, xrefs: 005E53F2
4oST, xrefs: 005E5D48
4oST, xrefs: 005E4500
4oST, xrefs: 005E5750
_Ys, xrefs: 005E3FDE
K@z, xrefs: 005E40D1
4oST, xrefs: 005E615D
4oST, xrefs: 005E62E7
4oST, xrefs: 005E4A30
4oST, xrefs: 005E4DBE
4oST, xrefs: 005E3D23
MXg, xrefs: 005E4336
g[}, xrefs: 005E6676
HFd, xrefs: 005E62BB
4oST, xrefs: 005E64A0
_Ys, xrefs: 005E4FF3
GoST, xrefs: 005E37A6
4oST, xrefs: 005E635F
4oST, xrefs: 005E3C06
O_w, xrefs: 005E6333
4oST, xrefs: 005E4565
4oST, xrefs: 005E465B

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID: 4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$=J ]$=J ]$GoST$GoST$HFd$HFd$HWg$HWg$K@z$K@z$K@z$K@z$MXg$MXg$MXg$MXg$O_w$O_w$UYw$UYw$UYw$UYw$_Ys$_Ys$_Ys$_Ys$g[}
API String ID: 453214671-3780945421
Opcode ID: af066d5522e4fa94385c48b80a1f9a923ca951834f9772ce006a3c56508fb90d
Instruction ID: 0fb785ef137a7310addd06c25158ea7cc1e25133e38fe072feffe26166788004
Opcode Fuzzy Hash: af066d5522e4fa94385c48b80a1f9a923ca951834f9772ce006a3c56508fb90d
Instruction Fuzzy Hash: 3C53CAB4D052A98FDB69DF14C894BDDBBB5BB48304F1041EAE44AA7282DB306F84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 005DE090 Relevance: 53.3, APIs: 10, Strings: 20, Instructions: 832
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0058B8E0: CreateDirectoryA.KERNELBASE(?,00000000), ref: 0058BA08

CreateDirectoryA.KERNELBASE(?,00000000), ref: 005DE192
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 005DE322
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 005DE415
CreateDirectoryA.KERNEL32(?,00000000), ref: 005DE50B
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 005DE757
CreateDirectoryA.KERNELBASE(?,00000000), ref: 005DE8D5
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 005DEA65
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 005DEB58

Part of subcall function 00664050: GetFileAttributesA.KERNELBASE(?,?,00000006,00000005,00000005), ref: 006640AC
Part of subcall function 00664050: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 006640B7

CreateDirectoryA.KERNEL32(?,00000000), ref: 005DEC4E
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,-0000004C), ref: 005DEEA6

Part of subcall function 006549B0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,006D80C7,000000FF), ref: 00654A1C
Part of subcall function 006549B0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00654A43

Strings

rPw, xrefs: 005DE535
wWs, xrefs: 005DED4B
4oST, xrefs: 005DE358
4oST, xrefs: 005DE5C3
4oST, xrefs: 005DED12
4oST, xrefs: 005DE9C4
voST, xrefs: 005DECA4
4oST, xrefs: 005DED77
rPw, xrefs: 005DEC78
wWs, xrefs: 005DE5F0
4oST, xrefs: 005DE61C
4oST, xrefs: 005DE691
4oST, xrefs: 005DE458
4oST, xrefs: 005DE869
4oST, xrefs: 005DEB9B
voST, xrefs: 005DE561
4oST, xrefs: 005DEA9B
4oST, xrefs: 005DE281
4oST, xrefs: 005DE120
4oST, xrefs: 005DEDEC

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: CreateDirectory$FolderPath$AttributesErrorFileLast
String ID: 4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$rPw$rPw$voST$voST$wWs$wWs
API String ID: 3066340180-3074812837
Opcode ID: 69f8e08afaf843fe01a63ed14b32f3279fae3717491850262754cf5fe5a9220a
Instruction ID: 535535a6905cc755781ec70da11ba18c999e92757948cb6054d77cc86b616009
Opcode Fuzzy Hash: 69f8e08afaf843fe01a63ed14b32f3279fae3717491850262754cf5fe5a9220a
Instruction Fuzzy Hash: E39212B0C052A98FDB25EB64CC99BDDBBB4BB54304F1041EAD449A7282EB305F89CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00661AD0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 291
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegGetValueA.KERNELBASE(80000002,?,?,0001FFFF,?,?,00000104), ref: 00661E20
GetComputerNameExA.KERNELBASE(00000002,?,00000104), ref: 00661E8C
LsaOpenPolicy.ADVAPI32(00000000,00704684,00000001,?), ref: 00661EE5
LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 00661EF8
LsaFreeMemory.ADVAPI32(?), ref: 00661F26
LsaClose.ADVAPI32(?), ref: 00661F2F

Strings

%wZ, xrefs: 00661F15
4oST, xrefs: 00661CD7

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ$4oST
API String ID: 762890658-2776467258
Opcode ID: 6b56dd40da8cf60e37bf9d2e6ff274bc834517420080dc5e324493b2f74ac0f6
Instruction ID: b2baa7a8f24b55c81f077ddcf5bf022b3de1a68285d21b286653cc0c81a85152
Opcode Fuzzy Hash: 6b56dd40da8cf60e37bf9d2e6ff274bc834517420080dc5e324493b2f74ac0f6
Instruction Fuzzy Hash: 8DE1FFB4D0425ACBDB15CF98C985BEEBBB5BF08304F244199E949BB341D7305A85CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00645940 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0064596A
getaddrinfo.WS2_32(?,?,?,00706328), ref: 006459EC
socket.WS2_32(?,?,?), ref: 00645A0D
connect.WS2_32(00000000,006D6B31,?), ref: 00645A21
closesocket.WS2_32(00000000), ref: 00645A2D
FreeAddrInfoW.WS2_32(?), ref: 00645A3A
WSACleanup.WS2_32 ref: 00645A40
FreeAddrInfoW.WS2_32(?), ref: 00645A55

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: e7e8cb3b0a870c71bd2a64a622cb189af820c7298427b6f53c4e492fcbdf4a47
Instruction ID: dcc519960235adec741569535657ed677e4efba7be30fc2c4a20ba58055c5df3
Opcode Fuzzy Hash: e7e8cb3b0a870c71bd2a64a622cb189af820c7298427b6f53c4e492fcbdf4a47
Instruction Fuzzy Hash: B031C1329097009BD7209F64DC84B6ABBE7FB85734F14171EF8A6D32E1D73098448A92

Uniqueness

Uniqueness Score: -1.00%

Function 00589280 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll), ref: 005896A6
GetProcAddress.KERNEL32(00000000,?), ref: 005896B4
WSASend.WS2_32(?,?,00000001,?,00000000,00000000,00000000), ref: 005896C9

Strings

4oST, xrefs: 0058962C
Ws2_32.dll, xrefs: 0058969A
4oST, xrefs: 00589660

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: 4oST$4oST$Ws2_32.dll
API String ID: 2819740048-1839276265
Opcode ID: 3220401241038fa18762d3a8daa77d07aeda79d4fb1a927916b189adcb00d4f3
Instruction ID: 13ea050ec9779b81eeff784ac562a49081f77b446c843f8a515a4a359a31dde6
Opcode Fuzzy Hash: 3220401241038fa18762d3a8daa77d07aeda79d4fb1a927916b189adcb00d4f3
Instruction Fuzzy Hash: EF02CB70D04298DFDF25DFA4C8907ADBFB0FF55314F284289E8866B686D7701986CB92

Uniqueness

Uniqueness Score: -1.00%

Function 005C8900 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 822338774a1b8ea60f019c5abe9955702119d0ed444e1e064332341473fd9022
Instruction ID: 937fd735b6b4a4a3290fd3d22016ba067fc6bb89f61c6acf54598474fccfbf62
Opcode Fuzzy Hash: 822338774a1b8ea60f019c5abe9955702119d0ed444e1e064332341473fd9022
Instruction Fuzzy Hash: 80B1BFB0A0464AAFDB119FD8C885FBE7FB1BB85314F18419DE4149B392CB749D81CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00662BA0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 350COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00662C3F
GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00662F4B

Strings

be, xrefs: 00662BAD
4oST, xrefs: 00662FC6

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: DirectoryInformationVolumeWindows
String ID: 4oST$be
API String ID: 3487004747-1578759084
Opcode ID: 5892ecfec0b3b041cf95d487ca72bfbe25ef839561eadf0a641ba98f83c5fbeb
Instruction ID: d7ac075cd8d73adb9794d905de38f3449490069702ed5937e578f1c0fa432e7b
Opcode Fuzzy Hash: 5892ecfec0b3b041cf95d487ca72bfbe25ef839561eadf0a641ba98f83c5fbeb
Instruction Fuzzy Hash: 14F147B0C0124A9FDB15CFA8C995BEEFBB1BF44304F244159E405BB341D7716A85CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00653B40 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 278fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 00653DD0

Part of subcall function 00653F50: GetLastError.KERNEL32(?,00000000), ref: 00653F83
Part of subcall function 00653F50: 6E277CF0.RSTRTMGR(?,00000000,?), ref: 00654000

std::_Throw_Cpp_error.LIBCPMT ref: 00653F34
std::_Throw_Cpp_error.LIBCPMT ref: 00653F45

Strings

4oST, xrefs: 00653D17

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CopyE277ErrorFileLast
String ID: 4oST
API String ID: 911205731-3759581069
Opcode ID: 9db619d2fe55ba736a6d8acac9d60f28becba643e0b48d5b7d9d3eded6652360
Instruction ID: c33be0a8502ce6a2ef5448ba1b002cf4c094cdb77a654c4e94d8a79e3da4876a
Opcode Fuzzy Hash: 9db619d2fe55ba736a6d8acac9d60f28becba643e0b48d5b7d9d3eded6652360
Instruction Fuzzy Hash: E4D157B0C01249DBDB14DFA8C9557EEBFB1BF55304F244299D80977382EB345A89CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00611680 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 264registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000001,?), ref: 006118A9
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,?), ref: 006118CC
RegCloseKey.ADVAPI32(?), ref: 006118D7

Strings

4oST, xrefs: 006117B6

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: 4oST
API String ID: 3677997916-3759581069
Opcode ID: ff789d02da03f46eb8f29bc17915d87cd62d1ab5966e0cbb7a6d159394e3ec90
Instruction ID: 5bfe7cd2ba92a0373c9d1d9ace0f2ebde26de5cf4b3ffb7ef8e056977d9f88ea
Opcode Fuzzy Hash: ff789d02da03f46eb8f29bc17915d87cd62d1ab5966e0cbb7a6d159394e3ec90
Instruction Fuzzy Hash: 0BC125B0D0525A9FDB14CFA8C985BEEBBB1BF48310F244159E914BB381D7346A84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00664050 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,00000006,00000005,00000005), ref: 006640AC
GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 006640B7
std::_Throw_Cpp_error.LIBCPMT ref: 006640FF
std::_Throw_Cpp_error.LIBCPMT ref: 00664110

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: 9d3cbd08286845e5545fca0de44204043866c039d4551daccac38bda18a6e56f
Instruction ID: 870c148416f2ba89bf1a4ef0533ef3923c34ce36ba3c6e09ace4b04dd3ea9874
Opcode Fuzzy Hash: 9d3cbd08286845e5545fca0de44204043866c039d4551daccac38bda18a6e56f
Instruction Fuzzy Hash: A6117671904251DFCB345F689C197E97BA7EB03734F240325E9359FBC0DF22896886A2

Uniqueness

Uniqueness Score: -1.00%

Function 005CB9C2 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,005BD2A1,?), ref: 005CB9CA
GetLastError.KERNEL32(?,005BD2A1,?), ref: 005CB9D4
__dosmaperr.LIBCMT ref: 005CB9DB

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 90617cad62c082631d03a6c5bc5ac537aa9016297b5a97aa0c847db740854ee5
Instruction ID: c1b4e780a066e8200e83f59001866e6df8d8f35864b4f12f039e777023987215
Opcode Fuzzy Hash: 90617cad62c082631d03a6c5bc5ac537aa9016297b5a97aa0c847db740854ee5
Instruction Fuzzy Hash: 74D022320092087B8B002BF2BC0DE163F1EABC0378B181216F02CC80A0DF32C8808141

Uniqueness

Uniqueness Score: -1.00%

Function 006649F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00664B5C

Strings

4oST, xrefs: 00664AB2

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: __fread_nolock
String ID: 4oST
API String ID: 2638373210-3759581069
Opcode ID: 7e42ffd54b1cd49a256bc825063568773be0a5cdd7b5c628955af0755d47b2a1
Instruction ID: 5b19277eaeb37d3e11e38c0b846bf06ae754c19696923342b9d63340885df0e6
Opcode Fuzzy Hash: 7e42ffd54b1cd49a256bc825063568773be0a5cdd7b5c628955af0755d47b2a1
Instruction Fuzzy Hash: 7D515EB0D042499BCB20DF98C946BAEFBF1FF44700F20011DE8416B381DB75AA45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00664870 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 006649B9

Strings

4oST, xrefs: 00664912

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: __fread_nolock
String ID: 4oST
API String ID: 2638373210-3759581069
Opcode ID: c91e78deb482296c310711d078886bde60ad9ec7c45c5b9c0c45c6dba021c87b
Instruction ID: 4e81925e2cecd373efe4dc43bd7ee9ae95be3564c048d28f51fa9095690467f8
Opcode Fuzzy Hash: c91e78deb482296c310711d078886bde60ad9ec7c45c5b9c0c45c6dba021c87b
Instruction Fuzzy Hash: A3415DB0D00249DFCB10DF99C885BEEBBB5FF48700F144159E814AB381E735A902CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 005C9779 Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005C8E8F: GetConsoleOutputCP.KERNEL32(98B540BF,00000000,00000000,005BD0B7), ref: 005C8EF2

WriteFile.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,?,006641EC,?,005BCFD7,006641EC,?,006F6E10,00000010,005BD0B7), ref: 005C98FE
GetLastError.KERNEL32(?,005BCFD7,006641EC,?,006F6E10,00000010,005BD0B7,006641EC,?,00000000), ref: 005C9908

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 9dbae71151ae784122d0f46edbbb350fc784ff6b4339345303810d74bc0aa5b6
Instruction ID: 8d58bbe3d8a5b8363d21c634985807bd06668354e304b947fecf85974e6334de
Opcode Fuzzy Hash: 9dbae71151ae784122d0f46edbbb350fc784ff6b4339345303810d74bc0aa5b6
Instruction Fuzzy Hash: FC618D7290411AAFDF119FE8C888FEEBFB9BB4A304F14054DE904A7256D736D941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 006539A0 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00653B1A
std::_Throw_Cpp_error.LIBCPMT ref: 00653B2B

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 2a4b6e64a6cb23af4ae6a7b80ab9b7255c1e439c3bcabc5a8a12954c45563e26
Instruction ID: cc5059400ea9befbbd5ed11e185662f85f5ab2755e2e5976510e4e286ed64c37
Opcode Fuzzy Hash: 2a4b6e64a6cb23af4ae6a7b80ab9b7255c1e439c3bcabc5a8a12954c45563e26
Instruction Fuzzy Hash: 8D411671E00202CBC724DF28DD5176ABBE5FB80710F184329E85157385EB75AA14CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 005C8DEF Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,005C8CD6,00000000,CF830579,006F7178,0000000C,005C8D92,005BD06D,?), ref: 005C8E45
GetLastError.KERNEL32(?,005C8CD6,00000000,CF830579,006F7178,0000000C,005C8D92,005BD06D,?), ref: 005C8E4F

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 29bd7f040d35b43e26140018ae2464dd4ee985ef0c4325e65a377050f6d4c345
Instruction ID: c80b9baaa0d56fc93caaa52b1d8e60c767b09d2d09e9da0d08bd17090f09c5b0
Opcode Fuzzy Hash: 29bd7f040d35b43e26140018ae2464dd4ee985ef0c4325e65a377050f6d4c345
Instruction Fuzzy Hash: 8C11E536A042105ED62526F4A94EF7E2F4DAB82734F29065DF8189B2D2DF719C80C195

Uniqueness

Uniqueness Score: -1.00%

Function 005C250C Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,005BD0B7,00000000,00000002,00000000,00000000,00000000,00000000,?,005C2646,00000000,00000000,005BD0B7,00000002,00000000), ref: 005C2548
GetLastError.KERNEL32(00000000,?,005C2646,00000000,00000000,005BD0B7,00000002,00000000,?,005C981E,00000000,00000000,00000000,00000002,005BD0B7,00000000), ref: 005C2555

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 369f3ce6f9fa430ddb514bfb4bb6dc2aebf8fbd28660bc168c2f1576b5683cd8
Instruction ID: a20d0d88fc61494125f00d1b3c157b0b06bf35c49c213bc2ea134b8b0ff25cd4
Opcode Fuzzy Hash: 369f3ce6f9fa430ddb514bfb4bb6dc2aebf8fbd28660bc168c2f1576b5683cd8
Instruction Fuzzy Hash: CA01C432614515AFCF058F99EC19E9F3F29EB85320F240209F8119B291E671EA918B90

Uniqueness

Uniqueness Score: -1.00%

Function 005CB00C Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,005D1B36,?,00000000,?,?,005D1DD7,?,00000007,?,?,005D22CB,?,?), ref: 005CB022
GetLastError.KERNEL32(?,?,005D1B36,?,00000000,?,?,005D1DD7,?,00000007,?,?,005D22CB,?,?), ref: 005CB02D

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 436c163b63d67807dd9b234b3eaece09966fc4256bdfc5833e97435902004cd1
Instruction ID: 0479c639774227bc14af3e2f6383c71870e988f5d475f8fb0f857ccdeb3f17bf
Opcode Fuzzy Hash: 436c163b63d67807dd9b234b3eaece09966fc4256bdfc5833e97435902004cd1
Instruction Fuzzy Hash: 1FE08C32504604AFDB212BE4EC0DF9A3F5AFB40355F084069F60CA7061DB398890CB89

Uniqueness

Uniqueness Score: -1.00%

Function 00595350 Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0059546E

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 56954a002820aa30db47d5a9d6176d3a9bda4e2b80b7ef1ffbee37294c42855c
Instruction ID: 14306b37bf1e88a8611d6d5dcefc31b5ac8f456a56fbe3e9ba0df5c345a1c695
Opcode Fuzzy Hash: 56954a002820aa30db47d5a9d6176d3a9bda4e2b80b7ef1ffbee37294c42855c
Instruction Fuzzy Hash: 69617BB1A01615DFCB11CF59C984B5ABBF4FF48710F14816EE4199B391D775D901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005A3800 Relevance: 1.7, APIs: 1, Instructions: 174COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 005A39F6

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2eb95ceaed4b124ffc4114fa4c0df12e788aad1587a0cdcf2b191dd49a90b40c
Instruction ID: 939b1efd026d4e64ab95d6713c5c3a227dda408ab8549b9100eb8a97cb201531
Opcode Fuzzy Hash: 2eb95ceaed4b124ffc4114fa4c0df12e788aad1587a0cdcf2b191dd49a90b40c
Instruction Fuzzy Hash: 2D51B4B1A00205DFDB08DF68DD96A9EFFA5BB89304F104229F405EB391DB75AA048BD1

Uniqueness

Uniqueness Score: -1.00%

Function 005B8DF2 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680e93d5d2a92bc1206685dce8a7ad5ecb83b1ae3ebb9eec0d78a82787a74955
Instruction ID: 48bc94eb74d88f999c0cf5b1e499533807b12e6b95122e14db799ec939db37fe
Opcode Fuzzy Hash: 680e93d5d2a92bc1206685dce8a7ad5ecb83b1ae3ebb9eec0d78a82787a74955
Instruction Fuzzy Hash: 69519470A00205EFDB14DF58C885AFA7FAAFB89314F289159F8099B352D771ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005A9E20 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 005A9F7B

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9725dd78bcf2699034c22ed2f3cab162847cf46e50b6caed5873c0cd26ece505
Instruction ID: f578efbafc130cc9267f38afaf9dab43b4b0ce7e6fa592fd301ce06e6b67ab8f
Opcode Fuzzy Hash: 9725dd78bcf2699034c22ed2f3cab162847cf46e50b6caed5873c0cd26ece505
Instruction Fuzzy Hash: CD41AF72A001259FCB14DF6CC945AAEBFB9FB89350F244229E815E7385D770AE018BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00586870 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00586908

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: ___std_fs_directory_iterator_open@12
String ID:
API String ID: 29801545-0
Opcode ID: cc3f79ab37948daf42f20f8c340cafd73ef3b7143eb14d17ae66da3beda90564
Instruction ID: 5a107d1d6fd0153db100a721c8ffc20b52d8dc58713944a03e672217b1db0511
Opcode Fuzzy Hash: cc3f79ab37948daf42f20f8c340cafd73ef3b7143eb14d17ae66da3beda90564
Instruction Fuzzy Hash: 73217176E00619ABCB14EF48D855BAEBBB4FB84721F10066AED1963780DB356D05CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 006630B0 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(006DA560,00000000,00000000), ref: 006630F7

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: 7708e7244ee6321c96cb2f8a37d1d874722ebb5af4ebd1ccb5484f6c6574e6b9
Instruction ID: 69b379c87c8344060091954945ee477a62d0471fe67403080564b8b8244d5c77
Opcode Fuzzy Hash: 7708e7244ee6321c96cb2f8a37d1d874722ebb5af4ebd1ccb5484f6c6574e6b9
Instruction Fuzzy Hash: 41110BB0D08748ABE3208F28D906717FBF1EB01B20F10432EE851573C0E7B6AA5887D2

Uniqueness

Uniqueness Score: -1.00%

Function 005832D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0058331F

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 88e0f75f83d5f9e69285ef2088a1dfdc1055322beeb667a90db4e8c6ac7f301f
Instruction ID: 1a597648b09c67b14ab9d32b72b1a3069ec1d8c9bef190d329bd17c5bafcbb0f
Opcode Fuzzy Hash: 88e0f75f83d5f9e69285ef2088a1dfdc1055322beeb667a90db4e8c6ac7f301f
Instruction Fuzzy Hash: 8DF0B4721001059BCB147F64D4199E9BBE8FF543A2710097AFC8DE7212EF36EA40C790

Uniqueness

Uniqueness Score: -1.00%

Function 005CB9EA Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005CB086: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 005CB0B8

RtlReAllocateHeap.NTDLL(00000000,?,?,?), ref: 005CBA47

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 57c6aad247e513a3c7fbe090624abcea687c9b8b515e78836897b61c8bb3ebaa
Instruction ID: 6cb9248d566686542e7c9f26af6c28115b1dd542de3136a7c2ea11d1fd9fa936
Opcode Fuzzy Hash: 57c6aad247e513a3c7fbe090624abcea687c9b8b515e78836897b61c8bb3ebaa
Instruction Fuzzy Hash: F6F0C831511511AEFB316BE6AC0BF7B3F59BFC1771F14021DF89466191EB20DC4081A1

Uniqueness

Uniqueness Score: -1.00%

Function 005CA64C Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,000000FF,00000000), ref: 005CA68D

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 577c617d671873a601d986bbb8e211c3da839283a596f32551a5aa9d954f8505
Instruction ID: 5f7d1b156eda26614b6f63c1563c72db3c850de8497d215079bfb77d1529beba
Opcode Fuzzy Hash: 577c617d671873a601d986bbb8e211c3da839283a596f32551a5aa9d954f8505
Instruction Fuzzy Hash: 00F0E032D005295FDB225BF29C09F563F59BF81774B1D4119E805DA150DB34DC8086E6

Uniqueness

Uniqueness Score: -1.00%

Function 005CB086 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?), ref: 005CB0B8

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 75a7a9eb43b5f0473627c63173c5953f555980de720435390d35ee4ede65590e
Instruction ID: fc64ff84d6d81ecf72dcb5f4ebcc692a82ee7c6aa4211b0a687d148cc1d644b2
Opcode Fuzzy Hash: 75a7a9eb43b5f0473627c63173c5953f555980de720435390d35ee4ede65590e
Instruction Fuzzy Hash: 42E030315415116EFA3127F59C0EF5B6E99BF813A0F150129ED25B70D2DB649C4081E5

Uniqueness

Uniqueness Score: -1.00%

Function 00586840 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00586853

Part of subcall function 005B1F6B: FindNextFileW.KERNELBASE(?,?,?,00586858,?,?,?,?,0058691A,?,?,?,00000000,?,?), ref: 005B1F74

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: fff74abef5ad4ab776fc00913f1374bcbb9169b1c9b3633ac3d7d852fcb85055
Instruction ID: 91b4683b4830358e469d40f5cec44701e992c343e2f2fe6d91cd701fc87585d2
Opcode Fuzzy Hash: fff74abef5ad4ab776fc00913f1374bcbb9169b1c9b3633ac3d7d852fcb85055
Instruction Fuzzy Hash: 2FD0A921700822110F64762B381C8BF0EC96DC6BF0B80006ABD4DF3242FE008C0382A6

Uniqueness

Uniqueness Score: -1.00%

Function 005C66C5 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005C66CC

Memory Dump Source

Source File: 00000000.00000002.2085670647.0000000000581000.00000040.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.2085649478.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000702000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085670647.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.000000000071C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085848579.0000000000724000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000EBB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 818a4488c924f564890b7bad9d019eaadb901c1adc6dd5dcf7c64c3912ffd961
Instruction ID: ad6629f7ffd11b6174a9562b461983df810ca72c1aaff117a6ca991e8526eb41
Opcode Fuzzy Hash: 818a4488c924f564890b7bad9d019eaadb901c1adc6dd5dcf7c64c3912ffd961
Instruction Fuzzy Hash: 72E09AB2D0020E9ADF00DFE4C586FEFBBBCBB44310F504066A205E6141EB78A744CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0087EB8C Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 0087EBB7

Memory Dump Source

Source File: 00000000.00000002.2085940359.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00727000, based on PE: true

Associated: 00000000.00000002.2085940359.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000857000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000900000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085940359.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 41fad590f6ef5185148255f5165f52fc19730a4808fe9f9f5b171b348ba74a60
Instruction ID: 5afb5e39029e1de8c2ce3f8eb9e68fec2c21be6d7e7aa7ba3cae83a5df18b8f7
Opcode Fuzzy Hash: 41fad590f6ef5185148255f5165f52fc19730a4808fe9f9f5b171b348ba74a60
Instruction Fuzzy Hash: FEE0EC753141089BDF60CE5CD844B5B379DF78C324F10C411F50AE7208C274EC50A7A1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_234a68b484188ee7734158a9c3c1f48d2f1fcf9_2d68038f_092f1c61-e679-4284-adf0-35641287d6cd\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_f7fc5d77e4181bfc8c190387d813954cf99dd80_2d68038f_ba0e7d69-f458-483a-978e-dbc15423d24c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_c38d378e10faade69745bd4221c06297b5b1c26_d8abc321_c45c5e10-8fde-4227-81f3-86e9161f7cf4\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_703cab63ddfc30e52e5285a77dd3d65328718bd_cadc5c4f_ca1ea967-fef8-45d7-a94d-43811e9047c7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER713D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER72D4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER73DE.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0F7.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA126.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2BC.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2BD.tmp.WERInternalMetadata.xml

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre