34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 58:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T495,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample b50becdb79b1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b50becdb79b1…. Malware family: Zusy.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 20 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b"],"about":{"@type":"SoftwareApplication","name":"758c5213c3ffebe919633188f8c07747","applicationCategory":["peexe","executable"],"identifier":"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":20,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Ta3e,"758c5213c3ffebe919633188f8c07747.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000001b875699932d637390006f00687d4a7438f06f00705d63739f4b5ceafeffffff54ef6f0022486273f8ee6f0000008e76f0ef6f003b486273e0df167608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000080ef6f0000000000080000000000000000000000000000000000000000000000000000002387569900000000c0ef6f006992c675ffffffff3400000080ef6f00080000000000000000008e76f0ef6f002794c67588ef6f000b00000000000000d8ef6f00 (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02c8e741cef6f00226ed9730000fe04000000002d6ed97387dc77bf2d000000ecb78474a0ef6f00b1ce9800408ba200d8aca1001a00000080000000e0ee6f0000003a0064ef6f0070c8da736342c7ccfeffffff2d000000d0cc93742700000034ef6f00856adb731c23e07374ef6f00f85fdb7308000000bb69da73b269da73efdc77bf2d000000ecb7847427000000d0cc937448ef6f002d000000d0cc93742700000078ef6f00856adb731c23e073c0ef6f007e8a9274ee8c9274738a9274313343fa2d000000ecb7847427000000d0cc9374fc9afe04909afe04313343fa88ef6f00fc52d07474f06f00e0849274c92de28efeffffff738a9274 (UID: 00000000-00005752)37:T8b0,"758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005752)38:T173a,"758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005752) "758c5213c3ffebe919633188f8c07747.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00005752)39:T8a7,"758c5213c3ffebe919633188f8c07747.exe" loaded module "KERNEL32" at base 771e0000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75b60000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75b60000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75b60000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 760f0000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75b60000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75b60000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75b60000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73660000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "USER32.DLL" at base 76940000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "ADVAPI32.DLL" at base 743d0000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "NTDLL.DLL" at base 772b0000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "WINMM.DLL" at base 733f0000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "NTDLL" at base 772b0000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "KERNEL32.DLL" at base 771e0000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "GDI32.DLL" at base 768e0000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "SHELL32.DLL" at base 74820000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "OLE32.DLL" at base 76320000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "WS2_32.DLL" at base 75e80000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "CRYPT32.DLL" at base 74600000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "SHLWAPI.DLL" at base 75f00000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "GDIPLUS.DLL" at base 73a00000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "SETUPAPI.DLL" at base 76430000 "758c5213c3ffebe919633188f8c07747.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 771e00003a:T465,"758c5213c3ffebe919633188f8c07747" file has an entrypoint instructions - "jmp 0x9a300a,pcmpgtd mm4, qword ptr [ebx],add byte ptr [eax], al,add byte ptr [eax], al,add cl, ch,add byte ptr [eax], ah,add byte ptr [eax], al,add byte ptr [ecx], al,or al, byte ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], dh,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [edi], al,add byte ptr [eax], 0,add byte ptr [eax], al,add byte ptr [eax], al,adc byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add dword ptr [edx], ecx,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,adc byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add ecx, dword ptr [edx],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,pop es,add byte ptr [eax], 0,"3b:T49c,"758c5213c3ffebe919633188f8c07747.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")3c:T969,"758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")3d:T54b,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005752.00000000.66615.00A10000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005752.00000000.66615.00A10000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005752.00000000.66615.00A10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005752.00000000.66615.00A10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005752.00000000.66615.00A10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005752.00000000.66615.00A10000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005752.00000000.66615.00A10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005752.00000000.66615.00A10000.00000004.mdmp")3e:T5ce,"758c5213c3ffebe919633188f8c07747.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-45773226 [PID: 5752] "758c5213c3ffebe919633188f8c07747.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-45774743 [PID: 5752] "758c5213c3ffebe919633188f8c07747.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-46294350 [PID: 5752] "758c5213c3ffebe919633188f8c07747.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-46296105 [PID: 5752] "758c5213c3ffebe919633188f8c07747.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-47707830 [PID: 5752] "758c5213c3ffebe919633188f8c07747.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-47710122 [PID: 5752] "758c5213c3ffebe919633188f8c07747.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-48522675 [PID: 5752] "758c5213c3ffebe919633188f8c07747.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-48524292 [PID: 5752] "758c5213c3ffebe919633188f8c07747.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-49351746 [PID: 5752] "758c5213c3ffebe919633188f8c07747.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-49353469 [PID: 5752] "758c5213c3ffebe919633188f8c07747.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-50151504 [PID: 5752] "758c5213c3ffebe919633188f8c07747.exe" queried SystemProcessInformation at 00000000-00005752-00000C13-50153056 [PID: 5752]3f:T4e4,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003668.00000000.69944.00470000.00000004.mdmp, 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003668.00000000.69944.00470000.00000004.mdmp, 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp")40:T417,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "00000000-00005592.00000001.68484.00331000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00005592.00000001.68484.00331000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00005592.00000001.68484.00331000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp")41:Tc29,"758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")42:T6c5,"758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "758c5213c3ffebe919633188f8c07747.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")43:T1701,"UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 38803-1748-003DF210, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d" (Source: 38803-1830-003E3310, Indicator: "update %q.%s set type='%s', name=%q, tbl_name=%q, rootpage=#%d, sql=%q where rowid=#%d") "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 38803-1569-003E41D0, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 38803-1750-003DF940, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 38803-1827-003E3940, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 38803-1827-003E3940, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 38803-1599-003F1C30, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 38803-1599-003F1C30, Indicator: "select name rootpage sql from '%q'.%s"), "SELECT name rootpage sql FROM '%q'.%s WHERE %s" (Source: 38803-1626-003CFDC0, Indicator: "select name rootpage sql from '%q'.%s where %s"), "CREATE TABLE" (Source: 38803-1831-003E30A0, Indicator: "create table"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 38803-1656-003E5150, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 38803-1656-003E5150, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 38803-1753-003FEC90, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "CREATE TABLE sqlite_master(" (Source: 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp, Indicator: "create table sqlite_master(") "CREATE TABLE" (Source: 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp, Indicator: "create table") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp, Indicator: "select name rootpage sql from '%q'.%s")44:T7df,"758c5213c3ffebe919633188f8c07747.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "758c5213c3ffebe919633188f8c07747.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "758c5213c3ffebe919633188f8c07747.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "758c5213c3ffebe919633188f8c07747.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "758c5213c3ffebe919633188f8c07747.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135]45:T8b9,"GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 21 Feb 2024 11:29:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 21 Feb 2024 11:30:03 GMT Server: cloudflare CF-RAY: 858ea757dd171682-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 21 Feb 2024 11:30:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 21 Feb 2024 11:30:38 GMT Server: cloudflare CF-RAY: 858ea831b81b6804-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 21 Feb 2024 11:30:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 21 Feb 2024 11:31:10 GMT Server: cloudflare CF-RAY: 858ea8f91cb0cf7e-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220.......46:T9dd,"UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 38803-1748-003DF210, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d" (Source: 38803-1830-003E3310, Indicator: "update %q.%s set type='%s', name=%q, tbl_name=%q, rootpage=#%d, sql=%q where rowid=#%d") "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 38803-1569-003E41D0, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 38803-1750-003DF940, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 38803-1827-003E3940, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 38803-1827-003E3940, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 38803-1599-003F1C30, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 38803-1599-003F1C30, Indicator: "select name rootpage sql from '%q'.%s"), "SELECT name rootpage sql FROM '%q'.%s WHERE %s" (Source: 38803-1626-003CFDC0, Indicator: "select name rootpage sql from '%q'.%s where %s"), "CREATE TABLE" (Source: 38803-1831-003E30A0, Indicator: "create table"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 38803-1656-003E5150, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 38803-1656-003E5150, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 38803-1753-003FEC90, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d")47:T689,"758c5213c3ffebe919633188f8c07747.exe" called "WinHttpSendRequest" with parameters {"hRequest": "c8678" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "758c5213c3ffebe919633188f8c07747.exe" called "WinHttpSendRequest" with parameters {"hRequest": "de2b8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "758c5213c3ffebe919633188f8c07747.exe" called "WinHttpSendRequest" with parameters {"hRequest": "13b1c0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "MPGPH131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "aa7b38" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "MPGPH131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "abd7a8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "MPGPH131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "b1b208" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "RageMP131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4c8798" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "RageMP131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4d55b8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "RageMP131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "53a858" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"}48:T858,Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005236-00000C26-42646408") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00005236-00000C26-42647442") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00005236-00000C26-42647947") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00005236-00000C26-42648450") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00005236-00000C26-42648991") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00005236-00000C26-42650002") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005236-00000C26-42650505") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005236-00000C26-45890687") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005236-00000C26-46655635") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005236-00000C26-46656255") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005236-00000C26-46656847") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00005236-00000C26-46657432") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005236-00000C26-46657432") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005236-00000C26-46657432") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00005236-00000C26-46658596") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005236-00000C26-46658596") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00005236-00000C26-46659755") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005236-00000C26-48463983")49:Ta903,Found URL "https://t.me/riseprosupport131\\got" - Source: "00000000-00003668.00000000.69944.00470000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00003668.00000000.69944.012D1000.00000040.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00003668.00000000.69944.012D1000.00000040.mdmp") Found URL "http://www.maxmind.com/geoip/v2.1/city/mesystem" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://db-ip.com/demo/home.php?s=67.218.111.202db-ip.comecure" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://db-ip.com/demo/home.php?s=67.218.111.2021.3.6.1.4.1.11129.2.4.2c7d7k7d7s7d7" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://t.me/riseprosupportcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://ipinfo.io//" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://ipinfo.io/widget/demo/67.218.111.202" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl3.digicert.com/cloudflareincrsaca-2.crl071http://crl4.digicert.com/cloudflareincrsaca-2.crl0>705030)0'http://www.digicert.com/cps0vj0h0$http://ocsp.digicert.com0@4http://cacerts.digicert.com/cloudflareincrsaca-2.crt0qhyfqc4i?9z6>.y8l(t$" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0mf0d070*0(https://www.digicert.com/cps0r.\ozj5u$^" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czczi-wf7igf7" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5of7m/f7mx6" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'gte" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0c+9ksalt" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,!!0ikwork1!0internet1verisign," - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrus.x^yat0$9ckx)wp+(salt" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nf7qwf779f7ntf7lif7" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9kgeotrust" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?us1!0the" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://t.)/\7b_logs_banner_1./\7^g_watermark_line_3" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://www.usertrust.com1w3\7" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=suuuhhsmqdy32" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=3k*jsp" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://t.me/risepro_bot2.16.840.1.114412.1.12.16.840.1.114412.1.2legram:" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://t.me/risepro_botisepro_bot1.3.6.1.5.5.7.3.31.3.6.1.5.5.7.3.4" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addresshttp://www.maxmind.com/geoip/v2.1/city/metp://185.215.113.46/mine/amert.exetp://185.215.113.46/cost/well.exetp://185.215.113.46/cost/niks.exetp://185.215.113.46/mine/plaza.exetp://185.215.113.46/cost/ladas.exelegram:" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://t.me/risepro_botlegram:" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://t.me/risepro_botelegram:" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://t.me/risepro_bot" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressmozilla/5.0" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressuser-agent:" - Source: "00000000-00003668.00000001.70532.00470000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00003668.00000001.70532.012D1000.00000040.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00003668.00000001.70532.012D1000.00000040.mdmp") Found URL "https://t.me/riseprosupportc:\758c5213c3ffebe919633188f8c07747.exec:\758c5213c3ffebe919633188f8c07747.exec:\programdata\mpgph131\mpgph131.exe\gotcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00005236.00000000.65576.00070000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00005236.00000000.65576.00D41000.00000040.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00005236.00000000.65576.00D41000.00000040.mdmp") Found URL "http://www.maxmind.com/geoip/v2.1/city/me79" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://db-ip.com/demo/home.php?s=67.218.111.202slfreeobjectmsiscanbufferey" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://t.me/riseprosupport\758c5213c3ffebe919633188f8c07747.execertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://ipinfo.io/05bf1bdddbdddldapijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/t\windorentverows" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://ipinfo.io/widget/demo/67.218.111.2021.2.840.113549.1.9.16.2.1hb" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://crl3.digicert.com/cloudflareincrsaca-2.crl071http://crl4.digicert.com/cloudflareincrsaca-2.crl0>705030)0'http://www.digicert.com/cps0vj0h0$http://ocsp.digicert.com0@4http://cacerts.digicert.com/cloudflareincrsaca-2.crt0qhyfqc4i?9z6>.y8l(t$" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0mf0d070*0(https://www.digicert.com/cps0r.\ozj5u$^" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://db-ip.com/demo/home.php?s=67.218.111.202" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digu1.3.6.1.4.1.311.64.1.1dingtype" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0p1<92a@ef7www.entrust.net/cps_2048" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?3bv:t6a[jr0m0]>-xgjxx4bgeotrust" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://www.usust.-objn>k'cq81barizona1scottsdale1%0" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=suuuhhsmqdy32" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=3k*jsp" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://t.me/risepro_botisepro_botsepro
telegram:" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://t.me/risepro_bothttps://www.maxmind.com/en/locate-my-ip-addresshttp://www.maxmind.com/geoip/v2.1/city/metp://185.215.113.46/mine/amert.exetp://185.215.113.46/cost/well.exetp://185.215.113.46/cost/niks.exetp://185.215.113.46/mine/plaza.exetp://185.215.113.46/cost/ladas.exelegram:" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://t.me/risepro_botlegram:" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://t.me/risepro_botelegram:" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://t.me/risepro_bot" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressmozilla/5.0" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://t.b_logs_banner_1g_watermark_line_3" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressuser-agent:" - Source: "00000000-00005236.00000001.66234.00070000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00005236.00000001.66234.00D41000.00000040.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00005236.00000001.66234.00D41000.00000040.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00005592.00000000.67932.00331000.00000040.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00005592.00000000.67932.00331000.00000040.mdmp") Found URL "https://t.me/riseprosupportc:\programdata\mpgph131\mpgph131.exe\programdata\mpgph131\mpgph131.exe\users\hapubws\appdata\local\temp\programdata\mpgph131\mpgph131.exe131\\gotcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00005592.00000000.67932.00A50000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00005592.00000001.68484.00331000.00000040.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00005592.00000001.68484.00331000.00000040.mdmp") Found URL "http://www.maxmind.com/geoip/v2.1/city/mesystem" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://db-ip.com/demo/home.php?s=67.218.111.202db-ip.comslfreeobjectmsiscanbufferey" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://t.me/riseprosupport\programdata\mpgph131\mpgph131.execertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://ipinfo.io/bdddbdddldapcommonprogramfiles=c:\program" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://ipinfo.io/widget/demo/67.218.111.202hb" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://db-ip.com/demo/home.php?s=67.218.111.2021.3.6.1.4.1.11129.2.4.21.3.6.1.4.1.311.2.1.101.3.6.1.4.1.311.2.1.271.3.6.1.4.1.311.10.3.301.3.6.1.4.1.311.10.11.15encdmicrosoft" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl3.digicert.com/cloudflareincrsaca-2.crl071http://crl4.digicert.com/cloudflareincrsaca-2.crl0>705030)0'http://www.digicert.com/cps0vj0h0$http://ocsp.digicert.com0@4http://cacerts.digicert.com/cloudflareincrsaca-2.crt0qhyfqc4i?9z6>.y8l(t$" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0mf0d070*0(https://www.digicert.com/cps0r.\ozj5u$^" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digcloudflare," - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czczi-wadigad" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5ostaat" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'c9w&-pttzic[fdad8kad79jy" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,!!0ikinternet1verisign," - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!adqwad79adntadliad" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?r0m01.3.6.1.5.5.7.1.12okb&]>-xgj2.16.840.1.113730.1.13xx4bfd29fd" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://t.b_logs_banner_1l?n(zy&g_watermark_line_3" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=suuu(hhsmqdy32" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=>z>ic/gp-h5t[u]" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://t.me/risepro_bot2.16.840.1.114412.1.12.16.840.1.114412.1.2legram:" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://t.me/risepro_botisepro_bot1.3.6.1.5.5.7.3.31.3.6.1.5.5.7.3.4" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addresshttp://www.maxmind.com/geoip/v2.1/city/metp://185.215.113.46/mine/amert.exetp://185.215.113.46/cost/well.exetp://185.215.113.46/cost/niks.exetp://185.215.113.46/mine/plaza.exetp://185.215.113.46/cost/ladas.exelegram:" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://t.me/risepro_botlegram:" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://t.me/risepro_botelegram:" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://t.me/risepro_bot" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressmozilla/5.0" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "https://www.maxmind.com/en/locate-my-ip-addressuser-agent:" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://185.215.113.46/cost/well.exe" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://185.215.113.46/mine/plaza.exe" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp") Found URL "http://185.215.113.46/cost/ladas.exe" - Source: "00000000-00005592.00000001.68484.00A50000.00000004.mdmp")4a:Tb0a,"758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")4b:T4bd,"CreateProcessA@KERNEL32.DLL" in "MPGPH131.exe" "CopyFileA@KERNEL32.DLL" in "MPGPH131.exe" "LoadLibraryA@KERNEL32.DLL" in "MPGPH131.exe" "RemoveDirectoryW@KERNEL32.DLL" in "MPGPH131.exe" "CopyFileW@KERNEL32.DLL" in "MPGPH131.exe" "FindResourceA@KERNEL32.DLL" in "MPGPH131.exe" "LoadResource@KERNEL32.DLL" in "MPGPH131.exe" "CreateProcessW@KERNEL32.DLL" in "MPGPH131.exe" "Process32NextW@KERNEL32.DLL" in "MPGPH131.exe" "LoadLibraryExW@KERNEL32.DLL" in "MPGPH131.exe" "CreateRemoteThread@KERNEL32.DLL" in "MPGPH131.exe" "RemoveDirectoryA@KERNEL32.DLL" in "MPGPH131.exe" "CreateDirectoryA@KERNEL32.DLL" in "MPGPH131.exe" "FindNextFileW@KERNEL32.DLL" in "MPGPH131.exe" "FindResourceW@KERNEL32.DLL" in "MPGPH131.exe" "GetLogicalDriveStringsW@KERNEL32.DLL" in "MPGPH131.exe" "LoadLibraryW@KERNEL32.DLL" in "MPGPH131.exe" "OpenMutexA@KERNEL32.DLL" in "MPGPH131.exe" "CreateDirectoryW@KERNEL32.DLL" in "MPGPH131.exe" "GetLogicalDriveStringsA@KERNEL32.DLL" in "MPGPH131.exe" "OpenMutexW@KERNEL32.DLL" in "MPGPH131.exe" "send@WS2_32.DLL" in "MPGPH131.exe" "FindFirstFileA@KERNEL32.DLL" in "MPGPH131.exe" "FindNextFileA@KERNEL32.DLL" in "MPGPH131.exe" "FindFirstFileW@KERNEL32.DLL" in "MPGPH131.exe"4c:Td87,"758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "758c5213c3ffebe919633188f8c07747.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")4d:T453,"www.maxmind.com" (Indicator: "maxmind.com"; File: "PCAP") "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" (Indicator: "maxmind.com"; File: "PCAP") "ipinfo.io" (Indicator: "ipinfo.io"; File: "PCAP") "https://ipinfo.io/" (Indicator: "ipinfo.io"; File: "00000000-00005236-00000CA0-47987892") "https://www.maxmind.com/en/locate-my-ip-address" (Indicator: "maxmind.com"; File: "00000000-00005236-00000CA0-50528347") "https://ipinfo.io/" (Indicator: "ipinfo.io"; File: "00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.00470000.00000004.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp") "https://www.maxmind.com/en/locate-my-ip-address" (Indicator: "maxmind.com"; File: "00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.00470000.00000004.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp")4e:Ta07,"MPGPH131.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004") "MPGPH131.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005") "MPGPH131.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005") "MPGPH131.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006") "MPGPH131.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006") "MPGPH131.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007") "MPGPH131.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007") "MPGPH131.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008") "MPGPH131.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008") "MPGPH131.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009") "MPGPH131.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009") "MPGPH131.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000010") "MPGPH131.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000010") "MPGPH131.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000011") "MPGPH131.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000011") "MPGPH131.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000012") "MPGPH131.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000012")4f:T99ec,Found XOR loop in file "RageMP131.exe" at offset 18158; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 40572; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 54580; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 196024; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 201180; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 226006; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 228300; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 250797; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 320748; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 328273; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 347284; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 358982; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 499742; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 500876; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 526681; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 543726; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 565646; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 590642; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 605233; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 636693; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 670146; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 674856; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 833041; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 887604; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1137540; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1313722; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1341247; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1426642; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1445949; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1451023; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1477990; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1543776; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1547603; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1675166; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1676203; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1680781; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1710665; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1712582; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1717210; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1767003; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1866519; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1871318; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1929860; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1958140; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1970987; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 1995782; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 2001603; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 2015206; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 2023051; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 2057349; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 2088933; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 2099433; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 2185792; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 2198446; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 2246195; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 2294636; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 2304666; code bytes = 30d0 Found XOR loop in file "RageMP131.exe" at offset 30465; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 67936; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 68453; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 71284; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 109664; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 118531; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 133359; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 162457; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 396992; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 472444; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 525463; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 610921; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 693705; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 718289; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 749681; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 882536; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 956114; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 1130672; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 1369210; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 1369699; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 1546368; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 1608423; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 1628676; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 1637230; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 1730687; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 1824709; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 1862272; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 1901140; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 1953624; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 2035206; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 2070790; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 2228314; code bytes = 33c1 Found XOR loop in file "RageMP131.exe" at offset 71738; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 84009; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 86130; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 93498; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 115236; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 214950; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 314460; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 322762; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 405392; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 462191; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 541116; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 556678; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 613780; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 621455; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 633217; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 639702; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 642968; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 807688; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 943576; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1061035; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1158439; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1295325; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1366592; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1370382; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1452648; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1473364; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1488395; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1488661; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1540322; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1543803; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1585958; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1592749; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1598527; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1684876; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1684945; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1687198; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1691048; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1691241; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1699501; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1703368; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1711837; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1745046; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1749187; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1753092; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1760326; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1787984; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1818424; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1818492; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1819438; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1825615; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1826068; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1831775; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1832212; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1859244; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1897798; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1923061; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1934153; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1936342; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1936538; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1953441; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1954749; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1975337; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 1995781; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2022546; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2039183; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2042210; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2048417; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2056984; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2065247; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2069037; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2069488; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2070023; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2091966; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2115736; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2126058; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2128568; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2175524; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2178158; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2196428; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2201036; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2203810; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2265923; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2266584; code bytes = 8030 Found XOR loop in file "RageMP131.exe" at offset 2302550; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9F6E50.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6A9F6E50.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9F6E50.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9F6E50.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 18158; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 40572; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 54580; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 196024; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 201180; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 226006; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 228300; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 250797; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 320748; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 328273; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 347284; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 358982; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 499742; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 500876; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 526681; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 543726; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 565646; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 590642; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 605233; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 636693; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 670146; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 674856; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 833041; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 887604; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1137540; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1313722; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1341247; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1426642; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1445949; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1451023; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1477990; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1543776; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1547603; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1675166; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1676203; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1680781; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1710665; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1712582; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1717210; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1767003; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1866519; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1871318; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1929860; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1958140; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1970987; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 1995782; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 2001603; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 2015206; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 2023051; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 2057349; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 2088933; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 2099433; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 2185792; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 2198446; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 2246195; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 2294636; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 2304666; code bytes = 30d0 Found XOR loop in file "MPGPH131.exe" at offset 30465; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 67936; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 68453; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 71284; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 109664; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 118531; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 133359; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 162457; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 396992; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 472444; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 525463; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 610921; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 693705; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 718289; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 749681; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 882536; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 956114; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 1130672; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 1369210; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 1369699; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 1546368; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 1608423; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 1628676; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 1637230; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 1730687; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 1824709; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 1862272; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 1901140; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 1953624; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 2035206; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 2070790; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 2228314; code bytes = 33c1 Found XOR loop in file "MPGPH131.exe" at offset 71738; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 84009; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 86130; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 93498; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 115236; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 214950; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 314460; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 322762; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 405392; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 462191; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 541116; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 556678; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 613780; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 621455; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 633217; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 639702; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 642968; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 807688; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 943576; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1061035; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1158439; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1295325; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1366592; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1370382; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1452648; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1473364; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1488395; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1488661; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1540322; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1543803; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1585958; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1592749; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1598527; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1684876; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1684945; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1687198; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1691048; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1691241; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1699501; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1703368; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1711837; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1745046; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1749187; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1753092; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1760326; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1787984; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1818424; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1818492; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1819438; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1825615; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1826068; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1831775; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1832212; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1859244; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1897798; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1923061; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1934153; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1936342; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1936538; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1953441; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1954749; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1975337; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 1995781; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2022546; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2039183; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2042210; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2048417; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2056984; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2065247; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2069037; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2069488; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2070023; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2091966; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2115736; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2126058; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2128568; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2175524; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2178158; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2196428; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2201036; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2203810; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2265923; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2266584; code bytes = 8030 Found XOR loop in file "MPGPH131.exe" at offset 2302550; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 18158; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 40572; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 54580; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 196024; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 201180; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 226006; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 228300; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 250797; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 320748; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 328273; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 347284; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 358982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 499742; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 500876; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 526681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 543726; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 565646; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 590642; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 605233; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 636693; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 670146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 674856; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 833041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 887604; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1137540; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1313722; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1341247; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1426642; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1445949; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1451023; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1477990; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1543776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1547603; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1675166; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1676203; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1680781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1710665; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1712582; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1717210; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1767003; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1866519; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1871318; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1929860; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1958140; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1970987; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1995782; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2001603; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2015206; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2023051; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2057349; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2088933; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099433; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2185792; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2198446; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2246195; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2294636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2304666; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 30465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 67936; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 68453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 71284; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 109664; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 118531; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 133359; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 162457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 396992; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 472444; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 525463; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 610921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 693705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 718289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 749681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 882536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 956114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1130672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1369210; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1369699; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1546368; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1608423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1628676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1637230; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1730687; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1824709; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1862272; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1901140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1953624; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2035206; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2070790; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2228314; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 71738; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 84009; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 86130; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 93498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 115236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 214950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 314460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 322762; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 405392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 462191; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 541116; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 556678; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 613780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 621455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 633217; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 639702; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 642968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 807688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 943576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1061035; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1158439; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1295325; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1366592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1370382; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1452648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1473364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1488395; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1488661; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1540322; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1543803; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1585958; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1592749; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1598527; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1684876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1684945; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1687198; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1691048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1691241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1699501; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1703368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1711837; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1745046; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1749187; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1753092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1760326; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1787984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1818424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1818492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1819438; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1825615; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1826068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1831775; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1832212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1859244; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1897798; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1923061; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1934153; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1936342; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1936538; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1953441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1954749; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1975337; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1995781; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2022546; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2039183; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2042210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2048417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2056984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2065247; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2069037; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2069488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2070023; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2091966; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2115736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2126058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2128568; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2175524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2178158; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2196428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2201036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2203810; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2265923; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2266584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2302550; code bytes = 803050:T5db,"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b.exe" called "GetSystemInfo" with parameters (UID: 00000000-00005780) "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b.exe" called "QueryPerformanceCounter" (UID: 00000000-00005780) "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b.exe" called "Process32FirstW" with parameters (UID: 00000000-00005780) "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b.exe" called "Process32NextW" with parameters (UID: 00000000-00005780) "schtasks.exe" called "GetSystemInfo" with parameters (UID: 00000000-00004172) "schtasks.exe" called "GetSystemMetrics" with parameters (UID: 00000000-00004172) "schtasks.exe" called "GetSystemInfo" with parameters (UID: 00000000-00006120) "schtasks.exe" called "GetSystemMetrics" with parameters (UID: 00000000-00006120) "MPGPH131.exe" called "GetSystemInfo" with parameters (UID: 00000000-00003640) "MPGPH131.exe" called "QueryPerformanceCounter" (UID: 00000000-00003640) "MPGPH131.exe" called "Process32FirstW" with parameters (UID: 00000000-00003640) "MPGPH131.exe" called "Process32NextW" with parameters (UID: 00000000-00003640) "MPGPH131.exe" called "GetSystemInfo" with parameters (UID: 00000000-00004012) "MPGPH131.exe" called "QueryPerformanceCounter" (UID: 00000000-00004012) "MPGPH131.exe" called "Process32FirstW" with parameters (UID: 00000000-00004012) "MPGPH131.exe" called "Process32NextW" with parameters (UID: 00000000-00004012)51:T7d8,"Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00005780.00000001.76617.00080000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00005780.00000001.76617.00080000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00005780.00000001.76617.00080000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00005780.00000001.76617.00080000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00005780.00000002.78540.00080000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00005780.00000002.78540.00080000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00005780.00000002.78540.00080000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00005780.00000002.78540.00080000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00005780.00000003.84059.00080000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00005780.00000003.84059.00080000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00005780.00000003.84059.00080000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00005780.00000003.84059.00080000.00000004.mdmp52:Tc2e,Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "CopySid" (Indicator: "CopySid"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "AddAce" (Indicator: "AddAce"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b")53:Td41,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6A9F6E50.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6A9F6E50.bin]54:T410,"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b.exe" called "getaddrinfo" with parameters {"pNodeName": "193.233.132.62" "pServiceName": "50500" "pHints": "441f968" "ppResult": "887f7a00"} "b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b.exe" called "getaddrinfo" with parameters {"pNodeName": "193.233.132.62" "pServiceName": "50500" "pHints": "441f968" "ppResult": "906e7a00"} "MPGPH131.exe" called "getaddrinfo" with parameters {"pNodeName": "193.233.132.62" "pServiceName": "50500" "pHints": "41df660" "ppResult": "887f2100"} "MPGPH131.exe" called "getaddrinfo" with parameters {"pNodeName": "193.233.132.62" "pServiceName": "50500" "pHints": "41df660" "ppResult": "906e2100"} "MPGPH131.exe" called "getaddrinfo" with parameters {"pNodeName": "193.233.132.62" "pServiceName": "50500" "pHints": "475fa40" "ppResult": "887f3600"} "MPGPH131.exe" called "getaddrinfo" with parameters {"pNodeName": "193.233.132.62" "pServiceName": "50500" "pHints": "475fa40" "ppResult": "906e3600"}55:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AB3d3d3d3d3d3d3d3d3d3AHd7u7u7u7u7u7u7u7u7d3B3u7u7u7u7u7u7u7u7u7dwe7u7u7u7u7t3d3ZmZmu7cHu7d3d2ZmZoj4iIiIhru3B7u4+IiIiIaI///4iIa7twe7uP//+IiGiP9vb2iHu7cHu4j/b29oh4j/////h7u3B7iI/////4eI/29vb4e7tweIiP9vb2+HiP////+Hi7cHiIj/////h4j/b29vh4i3B4iI/29vb4eI//////eIhweIiP/////3iP/////3iIcHiIj/////94j///+IiIiHB4iI////iIiI////+IiIhweIiI////iIiIiIiIiIiIcHiIiIiIiIiP/4iIiIiIiHCIiIiIj///////iIiIiIhwiIiIiIaP/////4aIiIiIcIiIiIhnaP////hnaIiIiHCIiIiGd3aP//+Gd3aIiIhwiIiIeId2aP/4eId2aIiIcIiIiIeHdmb4+IeHdmaIiICIiIj/eG//////eGiIiIiAiIiIj3hvj///j3hoiIiIgIiIiI+If/////+IeIiIiICIh4iPiH//9///iHiIh4iAiIiIiIiP/////4iIiIiIgIiIiHiIj3+IiHiIiHiIiIAAAAAAiGAAAAAAiGAAAAAAAAbwAAbwAAbwAAbwAAbwAAAAAAAAAAAAAAAAAAAAAACAAAADAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAf8f8f/nnnnn/////w==56:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AB3d3d3d3d3d3d3d3d3d3AHd7u7u7u7u7u7u7u7u7d3B3u7u7u7u7u7u7u7u7u7dwe7u7u7u7u7t3d3ZmZmu7cHu7d3d2ZmZoj4iIiIhru3B7u4+IiIiIaI///4iIa7twe7uP//+IiGiP9vb2iHu7cHu4j/b29oh4j/////h7u3B7iI/////4eI/29vb4e7tweIiP9vb2+HiP////+Hi7cHiIj/////h4j/b29vh4i3B4iI/29vb4eI//////eIhweIiP/////3iP/////3iIcHiIj/////94j///+IiIiHB4iI////iIiI////+IiIhweIiI////iIiIiIiIiIiIcHiIiIiIiIiP/4iIiIiIiHCIiIiIj///////iIiIiIhwiIiIiIaP/////4aIiIiIcIiIiIhnaP////hnaIiIiHCIiIiGd3aP//+Gd3aIiIhwiIiIeId2aP/4eId2aIiIcIiIiIeHdmb4+IeHdmaIiICIiIj/eG//////eGiIiIiAiIiIj3hvj///j3hoiIiIgIiIiI+If/////+IeIiIiICIh4iPiH//9///iHiIh4iAiIiIiIiP/////4iIiIiIgIiIiHiIj3+IiHiIiHiIiIAAAAAAiGAAAAAAiGAAAAAAAAbwAAbwAAbwAAbwAAbwAAAAAAAAAAAAAAAAAAAAAACAAAADAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAf8f8f/nnnnn/////w==57:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AB3d3d3d3d3d3d3d3d3d3AHd7u7u7u7u7u7u7u7u7d3B3u7u7u7u7u7u7u7u7u7dwe7u7u7u7u7t3d3ZmZmu7cHu7d3d2ZmZoj4iIiIhru3B7u4+IiIiIaI///4iIa7twe7uP//+IiGiP9vb2iHu7cHu4j/b29oh4j/////h7u3B7iI/////4eI/29vb4e7tweIiP9vb2+HiP////+Hi7cHiIj/////h4j/b29vh4i3B4iI/29vb4eI//////eIhweIiP/////3iP/////3iIcHiIj/////94j///+IiIiHB4iI////iIiI////+IiIhweIiI////iIiIiIiIiIiIcHiIiIiIiIiP/4iIiIiIiHCIiIiIj///////iIiIiIhwiIiIiIaP/////4aIiIiIcIiIiIhnaP////hnaIiIiHCIiIiGd3aP//+Gd3aIiIhwiIiIeId2aP/4eId2aIiIcIiIiIeHdmb4+IeHdmaIiICIiIj/eG//////eGiIiIiAiIiIj3hvj///j3hoiIiIgIiIiI+If/////+IeIiIiICIh4iPiH//9///iHiIh4iAiIiIiIiP/////4iIiIiIgIiIiHiIj3+IiHiIiHiIiIAAAAAAiGAAAAAAiGAAAAAAAAbwAAbwAAbwAAbwAAbwAAAAAAAAAAAAAAAAAAAAAACAAAADAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAf8f8f/nnnnn/////w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794221579543,"unified_at":"2026-11-09T10:52:59.543Z","metadata":{"hashes":{"sha256":"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","sha1":"fa534e53d645f69d1c950d8ff17e11e877ca970b","md5":"758c5213c3ffebe919633188f8c07747","sha512":"783cee4a35dab87271a126b8ae46f41e636ff9afeb2dc5620723fed828c4c72f991127ff7b8fd1de287cb8f63b825fe0ebeda7585b66acd1411b7050b2f1bda9","ssdeep":"49152:ov+pa5Mxg2VmKxuou1saUJ3iuL+y8g9Rdi8ZNaFwbdwUdUL:1pa5Mx9oKhaKdL+Lgo8ZoF0dw5L","ssdeep_chunks":["49152:ov+pa5M","49152:v+pa5Mx","49152:+pa5Mxg","49152:pa5Mxg2","49152:a5Mxg2V","49152:5Mxg2Vm","49152:Mxg2VmK","49152:xg2VmKx","49152:g2VmKxu","49152:2VmKxuo","49152:VmKxuou","49152:mKxuou1","49152:Kxuou1s","49152:xuou1sa","49152:uou1saU","49152:ou1saUJ","49152:u1saUJ3","49152:1saUJ3i","49152:saUJ3iu","49152:aUJ3iuL","49152:UJ3iuL+","49152:J3iuL+y","49152:3iuL+y8","49152:iuL+y8g","49152:uL+y8g9","49152:L+y8g9R","49152:+y8g9Rd","49152:y8g9Rdi","49152:8g9Rdi8","49152:g9Rdi8Z","49152:9Rdi8ZN","49152:Rdi8ZNa","49152:di8ZNaF","49152:i8ZNaFw","49152:8ZNaFwb","49152:ZNaFwbd","49152:NaFwbdw","49152:aFwbdwU","49152:FwbdwUd","49152:wbdwUdU","49152:bdwUdUL","98304:ov+pa5M","98304:v+pa5Mx","98304:+pa5Mxg","98304:pa5Mxg2","98304:a5Mxg2V","98304:5Mxg2Vm","98304:Mxg2VmK","98304:xg2VmKx","98304:g2VmKxu","98304:2VmKxuo","98304:VmKxuou","98304:mKxuou1","98304:Kxuou1s","98304:xuou1sa","98304:uou1saU","98304:ou1saUJ","98304:u1saUJ3","98304:1saUJ3i","98304:saUJ3iu","98304:aUJ3iuL","98304:UJ3iuL+","98304:J3iuL+y","98304:3iuL+y8","98304:iuL+y8g","98304:uL+y8g9","98304:L+y8g9R","98304:+y8g9Rd","98304:y8g9Rdi","98304:8g9Rdi8","98304:g9Rdi8Z","98304:9Rdi8ZN","98304:Rdi8ZNa","98304:di8ZNaF","98304:i8ZNaFw","98304:8ZNaFwb","98304:ZNaFwbd","98304:NaFwbdw","98304:aFwbdwU","98304:FwbdwUd","98304:wbdwUdU","98304:bdwUdUL","49152:1pa5Mx9","49152:pa5Mx9o","49152:a5Mx9oK","49152:5Mx9oKh","49152:Mx9oKha","49152:x9oKhaK","49152:9oKhaKd","49152:oKhaKdL","49152:KhaKdL+","49152:haKdL+L","49152:aKdL+Lg","49152:KdL+Lgo","49152:dL+Lgo8","49152:L+Lgo8Z","49152:+Lgo8Zo","49152:Lgo8ZoF","49152:go8ZoF0","49152:o8ZoF0d","49152:8ZoF0dw","49152:ZoF0dw5","49152:oF0dw5L"],"imphash":"2eabe9054cad5152567f0699947a2c5b"},"file_info":{"file_name":"758c5213c3ffebe919633188f8c07747","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2328576,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1708514857000,"last_seen":1788805694000,"last_multi_scan":1788805694000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","credentialharvesting","criminal","informationstealer","risepro","evasive"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":71},"sandbox_signatures":{"informative_count":156,"suspicious_count":26,"malicious_count":20,"total":202},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.TrojanX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Packed]/Win32.EnigmaProtector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.537941","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.537941 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.HZB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.038120A1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/Agent.g!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005376ae1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/RisePro-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"RisePro-FWJD!758C5213C3FF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/RisePro.C.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.VFI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Phpw.Win32.8609","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"RisePro","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"malicious","value":"The input sample contains a known anti-VM trick"},{"type":"suspicious","value":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"GETs files from a webserver"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Able to create or schedule tasks using domain/system privileges"},{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks internet related APIs"},{"type":"suspicious","value":"Hooks API calls"},{"type":"malicious","value":"Hooks file system APIs"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"suspicious","value":"Reference to an external IP address lookup service identified"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains reference to Sysinternals URL"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"&.dm\", Heuristic match: \"hl.bi\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005752.00000000.66615.00A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \";!RC2\" (Indicator: \"RC2\"; Source: \"00000000-00005752.00000000.66615.00FDE000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.963129291166755","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"758c5213c3ffebe919633188f8c07747.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"758c5213c3ffebe919633188f8c07747.exe\" called \"IsWow64Process\" with parameter \"5752\" - (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"758c5213c3ffebe919633188f8c07747.exe\" called \"GetWindowTextA\" with parameter \"Program Manager\" - (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"758c5213c3ffebe919633188f8c07747.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"758c5213c3ffebe919633188f8c07747.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"758c5213c3ffebe919633188f8c07747.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"758c5213c3ffebe919633188f8c07747.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"lstrcpy\"; File: \"758c5213c3ffebe919633188f8c07747\")\n Found reference to API (Indicator: \"FindClose\"; File: \"758c5213c3ffebe919633188f8c07747\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"DBWinMutex\"\n \"Local\\SM0:5752:168:WilStaging_02\"\n \"SM0:5752:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"758c5213c3ffebe919633188f8c07747.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74030000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"758c5213c3ffebe919633188f8c07747.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75F50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"758c5213c3ffebe919633188f8c07747\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"758c5213c3ffebe919633188f8c07747\" has an executable section named \"\"\n \"758c5213c3ffebe919633188f8c07747\" has an executable section named \"awogigmw\"\n \"758c5213c3ffebe919633188f8c07747\" has an executable section named \"nkfwixkm\"\n \"758c5213c3ffebe919633188f8c07747\" has an executable section named \".taggant\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"758c5213c3ffebe919633188f8c07747\" has an writable section named \"\"\n \"758c5213c3ffebe919633188f8c07747\" has an writable section named \".rsrc\"\n \"758c5213c3ffebe919633188f8c07747\" has an writable section named \".idata\"\n \"758c5213c3ffebe919633188f8c07747\" has an writable section named \"awogigmw\"\n \"758c5213c3ffebe919633188f8c07747\" has an writable section named \"nkfwixkm\"\n \"758c5213c3ffebe919633188f8c07747\" has an writable section named \".taggant\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3a","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"awogigmw\" is \"0x1a4400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x136000\" greater than 0x100000\n Virtual size of \"\" is \"0x2c1000\" greater than 0x100000\n Virtual size of \"awogigmw\" is \"0x1a5000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"758c5213c3ffebe919633188f8c07747.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"758c5213c3ffebe919633188f8c07747.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"758c5213c3ffebe919633188f8c07747.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 452 -p 5752 -ip 5752\" (UID: 00000000-00006584)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5752 -s 784\" (UID: 00000000-00007296)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5752 -s 784\" (UID: 00000000-00003208)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 452 -p 5752 -ip 5752\" (UID: 00000000-00006584)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5752 -s 784\" (UID: 00000000-00007296)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5752 -s 784\" (UID: 00000000-00003208)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"758c5213c3ffebe919633188f8c07747\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"758c5213c3ffebe919633188f8c07747.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"758c5213c3ffebe919633188f8c07747.exe\" queries basic process information of the \"C:\\758c5213c3ffebe919633188f8c07747.exe\" (UID: 5752)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"758c5213c3ffebe919633188f8c07747.exe\" reads file \"c:\\windows\\syswow64\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: The input sample contains a known anti-VM trick","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"758c5213c3ffebe919633188f8c07747.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"758c5213c3ffebe919633188f8c07747.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"758c5213c3ffebe919633188f8c07747.exe\" trying to touch file \"C:\\758c5213c3ffebe919633188f8c07747.exe\"\n \"758c5213c3ffebe919633188f8c07747.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"758c5213c3ffebe919633188f8c07747.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"758c5213c3ffebe919633188f8c07747.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"758c5213c3ffebe919633188f8c07747.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"758c5213c3ffebe919633188f8c07747.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"758c5213c3ffebe919633188f8c07747.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"758c5213c3ffebe919633188f8c07747.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"758c5213c3ffebe919633188f8c07747.exe\" trying to access non-existent file \"C:\\WINMM.DLL\"\n \"758c5213c3ffebe919633188f8c07747.exe\" trying to access non-existent file \"C:\\winmm.dll\"\n \"758c5213c3ffebe919633188f8c07747.exe\" trying to access non-existent file \"C:\\WINMMBASE.DLL\"\n \"758c5213c3ffebe919633188f8c07747.exe\" trying to access non-existent file \"C:\\WINMMBASE.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"758c5213c3ffebe919633188f8c07747.exe\" trying to access non-existent file \"C:\\758C5213C3FFEBE919633188F8C07747.EXE.LOCAL\"\n \"758c5213c3ffebe919633188f8c07747.exe\" trying to access non-existent file \"C:\\758c5213c3ffebe919633188f8c07747.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"758c5213c3ffebe919633188f8c07747.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"758c5213c3ffebe919633188f8c07747.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"758c5213c3ffebe919633188f8c07747.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"758c5213c3ffebe919633188f8c07747.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005752.00000000.66615.00A10000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005752.00000000.66615.00A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"758c5213c3ffebe919633188f8c07747.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$3e","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"???\n .rsrc\n awogigmw with unusual entropies 7.98730344696\n 7.62791461224\n 7.95350739786","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"758c5213c3ffebe919633188f8c07747.exe\" is setting 'ThreadHideFromDebugger' data for thread ID 0xfffffffe","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"758c5213c3ffebe919633188f8c07747.exe queries ProcessDebugPort (UID: 5752)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"758c5213c3ffebe919633188f8c07747.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"758c5213c3ffebe919633188f8c07747.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"z@0.q\"\n Pattern match: \"sw@v.7\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"758c5213c3ffebe919633188f8c07747.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00005752)\n \"758c5213c3ffebe919633188f8c07747.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"758c5213c3ffebe919633188f8c07747\" claimed CRC 2332835 while the actual is CRC 2370372","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"758c5213c3ffebe919633188f8c07747\" has an entrypoint in section \".taggant\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"758c5213c3ffebe919633188f8c07747.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"758c5213c3ffebe919633188f8c07747.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"VMware trick\" in \"sample.bin\" (Offset: 1497042)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003668.00000000.69944.04340000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005236.00000000.65576.04670000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005592.00000000.67932.04200000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Keep\" in header \"GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com\"\n Contains base64 string in header \"AliveReferer\" in header \"GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com\"\n Contains base64 string in header \"like\" in header \"GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005644)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"758c5213c3ffebe919633188f8c07747.exe\" queries volume information of \"C:\\\" at 00000000-00005236-0000010C-9059341\n \"MPGPH131.exe\" queries volume information of \"C:\\\" at 00000000-00005592-0000010C-6176878\n \"RageMP131.exe\" queries volume information of \"C:\\\" at 00000000-00003668-0000010C-6118186","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"758c5213c3ffebe919633188f8c07747.exe\" queries volume information of \"C:\\\" at 00000000-00005236-0000010C-9059341\n \"MPGPH131.exe\" queries volume information of \"C:\\\" at 00000000-00005592-0000010C-6176878\n \"RageMP131.exe\" queries volume information of \"C:\\\" at 00000000-00003668-0000010C-6118186","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"758c5213c3ffebe919633188f8c07747.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"758c5213c3ffebe919633188f8c07747.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)\" (SID: 2025331, Rev: 4, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$42","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"758c5213c3ffebe919633188f8c07747.exe\" called \"CopyFileA\" to copy C:\\758c5213c3ffebe919633188f8c07747.exe to new location %LOCALAPPDATA%\\RageMP131\\RageMP131.exe (UID: 00000000-00005236)\n \"758c5213c3ffebe919633188f8c07747.exe\" called \"CopyFileA\" to copy C:\\758c5213c3ffebe919633188f8c07747.exe to new location %ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe (UID: 00000000-00005236)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"758c5213c3ffebe919633188f8c07747.exe\" called \"CreateDirectoryA\" with parameter %LOCALAPPDATA%\\RageMP131 (UID: 00000000-00005236)\n \"758c5213c3ffebe919633188f8c07747.exe\" called \"CreateDirectoryA\" with parameter %ALLUSERSPROFILE%\\MPGPH131 (UID: 00000000-00005236)\n \"758c5213c3ffebe919633188f8c07747.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\adobeC4m7_wOWnkKO (UID: 00000000-00005236)\n \"758c5213c3ffebe919633188f8c07747.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\heidiC4m7_wOWnkKO (UID: 00000000-00005236)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"758c5213c3ffebe919633188f8c07747.exe\" called \"CreateProcessA\" with parameter \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\" /tn \"MPGPH131 HR\" /sc HOURLY /rl HIGHEST\" - (UID: 00000000-00005236)\n \"758c5213c3ffebe919633188f8c07747.exe\" called \"CreateProcessA\" with parameter \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\" /tn \"MPGPH131 LG\" /sc ONLOGON /rl HIGHEST\" - (UID: 00000000-00005236)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.maxmind.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"193.233.132.62:50500\"\n \"34.117.186.192:443\"\n \"104.26.4.15:443\"\n \"104.18.145.235:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$43","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"File Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00005236-00000574-1189764\")\n Found string \"Process Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00005236-00000574-1189878\")\n Found string \"Registry Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00005236-00000574-1196385\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00003668.00000000.69944.00470000.00000004.mdmp\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00003668.00000000.69944.00470000.00000004.mdmp\n \"Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00003668.00000000.69944.00470000.00000004.mdmp\n \"Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00003668.00000000.69944.00470000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$44","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.00470000.00000004.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$45","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016003cdaf16b@ADVAPI32.dll\"\n \"0e000f00ecdaf16b@ADVAPI32.dll\"\n \"0e000f0048dbf16b@ADVAPI32.dll\"\n \"1100120024e3f16b@ADVAPI32.dll\"\n \"11001200c0e3f16b@ADVAPI32.dll\"\n \"1200130004e4f16b@ADVAPI32.dll\"\n \"120013005ce4f16b@ADVAPI32.dll\"\n \"140015008005f26b@ADVAPI32.dll\"\n \"140015009805f26b@ADVAPI32.dll\"\n \"14001500b005f26b@ADVAPI32.dll\"\n \"17001800c805f26b@ADVAPI32.dll\"\n \"0d000e00e005f26b@ADVAPI32.dll\"\n \"0f0010000c07f26b@ADVAPI32.dll\"\n \"140015004c07f26b@ADVAPI32.dll\"\n \"140015006407f26b@ADVAPI32.dll\"\n \"0c000d00ac07f26b@ADVAPI32.dll\"\n \"0c000d00bc07f26b@ADVAPI32.dll\"\n \"0e000f00cc07f26b@ADVAPI32.dll\"\n \"180019003409f26b@RPCRT4.dll\"\n \"130014006009f26b@RPCRT4.dll\"\n \"140015007409f26b@RPCRT4.dll\"\n \"160017008c09f26b@RPCRT4.dll\"\n \"0b000c000402f26b@WS2_32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$46","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"MPGPH131.exe\" (UID: 00000000-00005592) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"db-ip.com\"\n \"ipinfo.io\"\n \"www.maxmind.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\bcryptprimitives.dll\" [Source: 00000000-00005236-00000C25-48992087]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00005644-00000C25-41908890]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"758c5213c3ffebe919633188f8c07747.exe\" searching for class \"OLLYDBG\"\n \"758c5213c3ffebe919633188f8c07747.exe\" searching for class \"GBDYLLO\"\n \"758c5213c3ffebe919633188f8c07747.exe\" searching for class \"pediy06\"\n \"758c5213c3ffebe919633188f8c07747.exe\" searching for class \"FilemonClass\"\n \"758c5213c3ffebe919633188f8c07747.exe\" searching for window \"File Monitor - Sysinternals: www.sysinternals.com\"\n \"758c5213c3ffebe919633188f8c07747.exe\" searching for class \"PROCMON_WINDOW_CLASS\"\n \"758c5213c3ffebe919633188f8c07747.exe\" searching for window \"Process Monitor - Sysinternals: www.sysinternals.com\"\n \"758c5213c3ffebe919633188f8c07747.exe\" searching for class \"RegmonClass\"\n \"758c5213c3ffebe919633188f8c07747.exe\" searching for window \"Registry Monitor - Sysinternals: www.sysinternals.com\"\n \"758c5213c3ffebe919633188f8c07747.exe\" searching for class \"18467-41\"\n \"758c5213c3ffebe919633188f8c07747.exe\" searching for class \"Regmonclass\"\n \"758c5213c3ffebe919633188f8c07747.exe\" searching for class \"Filemonclass\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"758c5213c3ffebe919633188f8c07747.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\rage131MP.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"RageMP131.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"rage131MP.tmp\" has type \"ASCII text with no line terminators\"- Location: [%TEMP%\\rage131MP.tmp]- [targetUID: 00000000-00005236]\n \"MPGPH131.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"RageMP131.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%LOCALAPPDATA%\\RageMP131\\RageMP131.exe]- [targetUID: 00000000-00005236]\n \"MPGPH131.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe]- [targetUID: 00000000-00005236]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"rage131MP.tmp\" has type \"ASCII text with no line terminators\" - Location: [%TEMP%\\rage131MP.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"schtasks.exe\" opens a process \"C:\\Windows\\System32\\schtasks.exe\" (UID: 00000000-00005704)\n \"schtasks.exe\" opens a process \"C:\\Windows\\System32\\schtasks.exe\" (UID: 00000000-00005644)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"758c5213c3ffebe919633188f8c07747.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\ragemp131\\ragemp131.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$47","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"758c5213c3ffebe919633188f8c07747.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"de2b8\"\n \"lpReserved\": \"0\"}\n \"758c5213c3ffebe919633188f8c07747.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"13b1c0\"\n \"lpReserved\": \"0\"}\n \"MPGPH131.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"abd7a8\"\n \"lpReserved\": \"0\"}\n \"MPGPH131.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"b1b208\"\n \"lpReserved\": \"0\"}\n \"RageMP131.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"4d55b8\"\n \"lpReserved\": \"0\"}\n \"RageMP131.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"53a858\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /geoip/v2.1/city/me\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"67.218.111.202\" found in string \"/widget/demo/67.218.111.202\"\n Potential IP \"67.218.111.202\" found in string \"/demo/home.php?s=67.218.111.202\"\n \"193.233.132.62\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"34.117.186.192\" on port \"443\"\n HTTPS traffic to \"104.26.4.15\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"758c5213c3ffebe919633188f8c07747.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\Certificates\\* (UID: 00000000-00005236)\n \"758c5213c3ffebe919633188f8c07747.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00005236)\n \"758c5213c3ffebe919633188f8c07747.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CRLs\\* (UID: 00000000-00005236)\n \"758c5213c3ffebe919633188f8c07747.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CTLs\\* (UID: 00000000-00005236)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath2W\" (Indicator: \"GetTempPath\"; Source: \"00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00003668.00000000.69944.00470000.00000004.mdmp\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00003668.00000000.69944.00470000.00000004.mdmp\n \"Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00003668.00000000.69944.00470000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003668.00000000.69944.012D1000.00000040.mdmp, 00000000-00003668.00000001.70532.012D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"758c5213c3ffebe919633188f8c07747.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"758c5213c3ffebe919633188f8c07747.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"MPGPH131.exe\" opened \"\\Device\\KsecDD\"\n \"RageMP131.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"RageMP131.exe\" - Location: [%LOCALAPPDATA%\\RageMP131\\RageMP131.exe]- [targetUID: 00000000-00005236]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)\" (SID: 2025331, Rev: 4, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"RageMP131.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"MPGPH131.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"RageMP131.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%LOCALAPPDATA%\\RageMP131\\RageMP131.exe]- [targetUID: 00000000-00005236]\n \"MPGPH131.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe]- [targetUID: 00000000-00005236]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"758c5213c3ffebe919633188f8c07747.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"RAGEMP131\"; Value: \"%LOCALAPPDATA%\\RageMP131\\RageMP131.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 34.117.186.192 on port 443 is sent without HTTP header\n TCP traffic to 104.26.4.15 on port 443 is sent without HTTP header\n TCP traffic to 104.18.145.235 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"ping 0, Gen\" (Indicator: \"ping\"; Source: \"00000000-00003668.00000000.69944.00470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"$4b","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"758c5213c3ffebe919633188f8c07747.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\12C\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"758c5213c3ffebe919633188f8c07747.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"RAGEMP131\"; Value: \"%LOCALAPPDATA%\\RageMP131\\RageMP131.exe\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Hooks file system APIs","description":"\"FindNextFileW@KERNEL32.DLL\" in \"MPGPH131.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"MPGPH131.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"MPGPH131.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"MPGPH131.exe\"\n \"FindNextFileW@KERNEL32.DLL\" in \"RageMP131.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"RageMP131.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"RageMP131.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"RageMP131.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-2","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"758c5213c3ffebe919633188f8c07747.exe\" allocated memory in \"C:\\758c5213c3ffebe919633188f8c07747.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"758c5213c3ffebe919633188f8c07747.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 392)\n \"758c5213c3ffebe919633188f8c07747.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 392)\n \"758c5213c3ffebe919633188f8c07747.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 392)\n \"758c5213c3ffebe919633188f8c07747.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 396)\n \"758c5213c3ffebe919633188f8c07747.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 396)\n \"758c5213c3ffebe919633188f8c07747.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 396)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ipinfo.io\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 193.233.132.62 on port 50500","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"send@WS2_32.DLL\" in \"MPGPH131.exe\"\n \"send@WS2_32.DLL\" in \"RageMP131.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"758c5213c3ffebe919633188f8c07747.exe\" (UID: 00000000-00005236)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\\\MPGPH131\\\\MPGPH131.exe\" /tn \"MPGPH131 HR\" /sc HOURLY /rl HIGHEST\" (UID: 00000000-00005704)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\\\MPGPH131\\\\MPGPH131.exe\" /tn \"MPGPH131 LG\" /sc ONLOGON /rl HIGHEST\" (UID: 00000000-00005644)\n Spawned process \"MPGPH131.exe\" (UID: 00000000-00005592)\n Spawned process \"RageMP131.exe\" (UID: 00000000-00003668)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"unknown compression method\" (Source: \"00000000-00003640.00000000.78818.01061000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor byte ptr [ebp+ecx-14h]\n al in Stream UID: 00000000-00005780-19106-3322-011E07A0\n Assembly shows XOR instruction xor byte ptr [ebp+ecx-14h]\n al in Stream UID: 00000000-00003640-27541-3319-010E07A0\n Assembly shows XOR instruction xor byte ptr [ebp+ecx-14h]\n al in Stream UID: 00000000-00004012-31177-3318-010E07A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$4f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005780-00000C2C-170126151\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005780-00000C2C-170126151\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"DISMHOST.EXE.6A9F6E50.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005780-00000C2C-175543391\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005780-00000C2C-175543594\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005780-00000C2C-175543990\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00003640.00000000.78818.01061000.00000040.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003640.00000000.78818.01061000.00000040.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00003640.00000000.78818.01061000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003640.00000000.78818.01061000.00000040.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00003640.00000000.78818.01061000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"$50","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005780)\n \"schtasks.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004172)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set list\" (Indicator: \"set \"; File: \"00000000-00005780.00000002.78540.01161000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"DISMHOST.EXE.6A9F6E50.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.6A9F6E50.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"DISMHOST.EXE.6A9F6E50.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; File: \"00000000-00005780.00000002.78540.01161000.00000040.mdmp\")\n Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003640.00000000.78818.01061000.00000040.mdmp\")\n Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003640.00000000.78818.01061000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$51","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"DISMHOST.EXE.6A9F6E50.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\schtasks.exe\" [Source: 00000000-00006120-00000C2B-174202364]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00004172-00000C2B-173444023]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to create or schedule tasks using domain/system privileges","description":"Found string \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\" /tn \"MPGPH131 HR\" /sc HOURLY /rl HIGHEST\" (Source: \"00000000-00005780-00000C46-9990436338\")\n Found string \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\" /tn \"MPGPH131 LG\" /sc ONLOGON /rl HIGHEST\" (Source: \"00000000-00005780-00000C46-11850780596\")","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":1,"id":"string-675","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00003640.00000000.78818.01610000.00000002.mdmp, 00000000-00003640.00000001.80742.01610000.00000002.mdmp, 00000000-00003640.00000002.82665.01610000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://ipinfo.io\"\n Found HTTPS url \"https://www.maxmind.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in file \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\"\n Found registry query API: \"RegOpenKeyExW\" in file \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \"MPGPH131.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$53","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"FindClose\" (Source: b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"DISMHOST.EXE.6A9F6E50.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\" has section name with entropy \"7.98730344696013\"\n \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\" has section name .rsrc with entropy \"7.627914612238417\"\n \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b\" has section name awogigmw with entropy \"7.953507397861078\"\n \"RageMP131.exe\" has section name with entropy \"7.98730344696013\"\n \"RageMP131.exe\" has section name .rsrc with entropy \"7.627914612238417\"\n \"RageMP131.exe\" has section name awogigmw with entropy \"7.953507397861078\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%LOCALAPPDATA%\\RageMP131\\RageMP131.exe\" has high entropy 7.96313\n Dropped file \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\" has high entropy 7.96313","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"$54","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Network Related","name":"Reference to an external IP address lookup service identified","description":"\"https://ipinfo.io/\" (Indicator: \"ipinfo.io\"; File: \"19106-3263-0117C320\")\n \"https://www.maxmind.com/en/locate-my-ip-address\" (Indicator: \"maxmind.com\"; File: \"19106-3263-0117C320\")\n \"https://ipinfo.io/\" (Indicator: \"ipinfo.io\"; File: \"00000000-00003640.00000000.78818.01061000.00000040.mdmp\")\n \"https://www.maxmind.com/en/locate-my-ip-address\" (Indicator: \"maxmind.com\"; File: \"00000000-00003640.00000000.78818.01061000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b.exe\" connects to 193.233.132.62 on port 50500 (TCP)\n Process \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\" connects to 193.233.132.62 on port 50500 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"\n YARA signature for null IAT Directory of PE file \"RageMP131.exe.784401918\"\n YARA signature for null IAT Directory of PE file \"MPGPH131.exe.1557518098\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegOpenKeyExW\n SetSecurityDescriptorDacl\n GetModuleHandleExW\n GetStartupInfoA\n GetFileAttributesW\n Sleep\n GetVersionExW\n FindResourceExW\n OutputDebugStringW\n GetModuleHandleA\n MapViewOfFile\n LoadLibraryW\n TerminateProcess\n GetModuleHandleW\n GetModuleFileNameW\n GetProcAddress\n GetVersionExA\n CreateFileMappingW\n OutputDebugStringA\n UnhandledExceptionFilter\n CreateThread\n LoadLibraryExW\n GetTickCount\n GetCommandLineW\n CreateFileW\n GetSystemDirectoryW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"17/26 Antivirus vendors marked dropped file \"RageMP131.exe\" as malicious (classified as \"Gen:Variant.Zusy\" with 65% detection rate)\n 17/26 Antivirus vendors marked dropped file \"MPGPH131.exe\" as malicious (classified as \"Gen:Variant.Zusy\" with 65% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"17/26 Antivirus vendors marked spawned process \"MPGPH131.exe\" (PID: 3640) as malicious (classified as \"Gen:Variant.Zusy\" with 65% detection rate)\n 17/26 Antivirus vendors marked spawned process \"MPGPH131.exe\" (PID: 4012) as malicious (classified as \"Gen:Variant.Zusy\" with 65% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 7 sections\" was dropped at \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\\\MPGPH131\\\\MPGPH131.exe\" /tn \"MPGPH131 HR\" /sc HOURLY /rl HIGHEST\" (UID: 00000000-00004172)\n Process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\\\MPGPH131\\\\MPGPH131.exe\" /tn \"MPGPH131 LG\" /sc ONLOGON /rl HIGHEST\" (UID: 00000000-00006120)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b.exe\" (UID: 00000000-00005780)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\\\MPGPH131\\\\MPGPH131.exe\" /tn \"MPGPH131 HR\" /sc HOURLY /rl HIGHEST\" (UID: 00000000-00004172)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\\\MPGPH131\\\\MPGPH131.exe\" /tn \"MPGPH131 LG\" /sc ONLOGON /rl HIGHEST\" (UID: 00000000-00006120)\n Spawned process \"MPGPH131.exe\" (UID: 00000000-00003640)\n Spawned process \"MPGPH131.exe\" (UID: 00000000-00004012)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]}],"intel_graph":{"map":{"Domain:db-ip.com":{"type":"Domain","value":"db-ip.com"},"Domain:ipinfo.io":{"type":"Domain","value":"ipinfo.io"},"Domain:www.maxmind.com":{"type":"Domain","value":"www.maxmind.com"},"File:39dc987fd3804e5f430d1820513f7070737c2ea57d2570a59ca3351169648933":{"type":"File","value":"39dc987fd3804e5f430d1820513f7070737c2ea57d2570a59ca3351169648933"},"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b":{"type":"File","value":"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat RisePro"]}},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"Ip:104.18.145.235":{"type":"Ip","value":"104.18.145.235"},"Ip:104.26.4.15":{"type":"Ip","value":"104.26.4.15"},"Ip:193.233.132.62":{"type":"Ip","value":"193.233.132.62"},"Ip:34.117.186.192":{"type":"Ip","value":"34.117.186.192"},"Threat:1b2393aaf717ebfec6cac1846d0c88b4b3dac26745addfa7b63ff89c65661fb0":{"type":"Threat","value":"RisePro","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Url:/geoip/v2.1/city/me":{"type":"Url","value":"/geoip/v2.1/city/me"}},"chains":[{"id":"1546587927483745233","root":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat RisePro"]}},{"id":"1546587927479550928","root":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"Threat:1b2393aaf717ebfec6cac1846d0c88b4b3dac26745addfa7b63ff89c65661fb0"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","edges":[{"edge_kind":"contacted_ip","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"Ip:193.233.132.62"},{"edge_kind":"contacted_ip","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"Ip:34.117.186.192"},{"edge_kind":"contacted_ip","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"Ip:104.26.4.15"},{"edge_kind":"contacted_ip","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"Ip:104.18.145.235"},{"edge_kind":"contacted_domain","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"Domain:db-ip.com"},{"edge_kind":"resolves_to","from_key":"Domain:db-ip.com","to_key":"Ip:104.26.4.15"},{"edge_kind":"contacted_domain","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"Domain:ipinfo.io"},{"edge_kind":"resolves_to","from_key":"Domain:ipinfo.io","to_key":"Ip:34.117.186.192"},{"edge_kind":"contacted_domain","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"Domain:www.maxmind.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.maxmind.com","to_key":"Ip:104.18.145.235"},{"edge_kind":"contacted_url","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"Url:/geoip/v2.1/city/me"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","edges":[{"edge_kind":"extracted","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b"},{"edge_kind":"extracted","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b"},{"edge_kind":"extracted","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b"},{"edge_kind":"extracted","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"File:39dc987fd3804e5f430d1820513f7070737c2ea57d2570a59ca3351169648933"},{"edge_kind":"extracted","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b"},{"edge_kind":"extracted","from_key":"File:b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":99,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["commodity","credentialharvesting","criminal","informationstealer","risepro","evasive"],"sample_flags":["Multi-Process","Sample Crashed","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a9f023d9330fdf0c406b39b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","contacted_countries":["RUS"],"submit_name":"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","analysis_start_time":"2026-09-07T18:28:14+00:00","indicators_count":{"informative":120,"suspicious":30,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"65d5df9296ce75af6c06215e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"758c5213c3ffebe919633188f8c07747","analysis_start_time":"2024-02-21T11:33:38+00:00","indicators_count":{"informative":49,"suspicious":12,"malicious":3},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true},{"id":"65d5de292ec76442c80e17a9","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS","USA"],"submit_name":"758c5213c3ffebe919633188f8c07747","analysis_start_time":"2024-02-21T11:27:37+00:00","indicators_count":{"informative":94,"suspicious":40,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"193.233.132.62","port":50500,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"address":"34.117.186.192","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"address":"104.26.4.15","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"address":"104.18.145.235","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]}],"dns_resolutions":[{"domain":"db-ip.com","address":"104.26.4.15","ttl":300,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Eris Networks SAS","registrar_name_servers":"NS1.T0X.NET","registrar_creation_date":"2010-05-18T20:21:20+00:00","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"domain":"ipinfo.io","address":"34.117.186.192","ttl":18,"country":"United States","registrar_name":"http://www.nic.ac/go/whois/ipinfo.ac","registrar_name_servers":"ns-595.awsdns-10.net","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"domain":"www.maxmind.com","address":"104.18.145.235","ttl":300,"country":"United States","registrar_name":"DOMAIN.COM, LLC","registrar_name_servers":"NS0.DNSMADEEASY.COM","registrar_creation_date":"2002-02-24T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]}],"http_requests":[{"host":"www.maxmind.com","host_ip":"104.18.145.235:80","url":"/geoip/v2.1/city/me","method":"GET","response_code":"403","response_phrase":"Forbidden","header":"GET /geoip/v2.1/city/me HTTP/1.1\nConnection: Keep-Alive\nReferer: https://www.maxmind.com/en/locate-my-ip-address\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\nHost: www.maxmind.com","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}],"processes":[{"pid":5236,"ppid":0,"name":"758c5213c3ffebe919633188f8c07747.exe","command_line":"","sha256":"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","normalized_path":"C:\\758c5213c3ffebe919633188f8c07747.exe","uid":"00000000-00005236","icon":"$55"},{"pid":5704,"ppid":5236,"name":"schtasks.exe","command_line":"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\" /tn \"MPGPH131 HR\" /sc HOURLY /rl HIGHEST","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00005236","uid":"00000000-00005704"},{"pid":5644,"ppid":5236,"name":"schtasks.exe","command_line":"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\" /tn \"MPGPH131 LG\" /sc ONLOGON /rl HIGHEST","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00005236","uid":"00000000-00005644"},{"pid":5592,"ppid":0,"name":"MPGPH131.exe","command_line":"","sha256":"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","normalized_path":"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe","uid":"00000000-00005592","icon":"$56"},{"pid":3668,"ppid":0,"name":"RageMP131.exe","command_line":"","sha256":"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","normalized_path":"%LOCALAPPDATA%\\RageMP131\\RageMP131.exe","uid":"00000000-00003668","icon":"$57"}],"all_imported_dlls":["wow64win.dll","sspicli.dll","fltLib.dll","ucrtbase.dll","gdi32.dll","SHCore.dll","powrprof.dll","wow64.dll","KernelBase.dll","rpcrt4.dll","cryptbase.dll","advapi32.dll","imm32.dll","winmmbase.dll","msasn1.dll","ntdll.dll","wow64cpu.dll","kernel32.dll","gdi32full.dll","msvcrt.dll","oleaut32.dll","kernel.appcore.dll","setupapi.dll","apphelp.dll","bcryptprimitives.dll","sechost.dll","combase.dll","winmm.dll","cfgmgr32.dll","windows.storage.dll","VxSSL32.dll","profapi.dll","crypt32.dll","ws2_32.dll","shlwapi.dll","ole32.dll","shell32.dll","GdiPlus.dll","user32.dll","win32u.dll","msvcp_win.dll","rasadhlp.dll","version.dll","taskschd.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","xmllite.dll","nsi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","uxtheme.dll","iertutil.dll","userenv.dll","secur32.dll","wininet.dll","bcrypt.dll","gpapi.dll","rsaenh.dll","ktmw32.dll","clbcatq.dll","ncrypt.dll","rpcss.dll","webio.dll","api-ms-win-downlevel-version-l1-1-0.dll","FWPUCLNT.DLL","mswsock.dll","credssp.dll","api-ms-win-core-synch-l1-2-0.dll","normaliz.dll","lpk.dll","wship6.dll","IPHLPAPI.DLL","usp10.dll","devobj.dll","winnsi.dll","schannel.dll","msctf.dll","dnsapi.dll","cryptsp.dll","winhttp.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","WSHTCPIP.DLL","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-core-file-l2-1-0.dll","msvcp140.dll","api-ms-win-crt-string-l1-1-0.dll","vcruntime140.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"MPGPH131.exe","sha256":"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"name":"RageMP131.exe","sha256":"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"name":"MPGPH131.exe.bin","sha256":"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"name":"rage131MP.tmp","sha256":"39dc987fd3804e5f430d1820513f7070737c2ea57d2570a59ca3351169648933","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"name":"RageMP131.exe.bin","sha256":"b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"name":"DISMHOST.EXE.6A9F6E50.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"path":"%LOCALAPPDATA%\\RageMP131\\RageMP131.exe","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"path":"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"path":"%TEMP%\\rage131MP.tmp","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"},{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"}]},{"name":"Local\\SM0:5752:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"}]},{"name":"SM0:5752:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65d5df9296ce75af6c06215e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"65d5de292ec76442c80e17a9"},{"report_type":"sandbox","report_id":"6a9f023d9330fdf0c406b39b"}]}]}},"report_ids":{"sandbox_job_ids":["6a9f023d9330fdf0c406b39b","65d5df9296ce75af6c06215e","65d5de292ec76442c80e17a9"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Zusy.Generic Sample b50becdb79b1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b50becdb79b1…. Malware family: Zusy.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 20 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample b50becdb79b1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b50becdb79b1…. Malware family: Zusy.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 20 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b50becdb79b109e85caa4f588343fdd7e96152f4e23f40ad213a0336118bc87b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample b50becdb79b1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b50becdb79b1…. Malware family: Zusy.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 20 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L58","11",{}]] 32:null