Source: Traffic |
Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49731 -> 77.91.77.66:58709 |
Source: Traffic |
Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49731 |
Source: Traffic |
Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49731 -> 77.91.77.66:58709 |
Source: Traffic |
Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49732 |
Source: Traffic |
Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49733 |
Source: Traffic |
Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49732 -> 77.91.77.66:58709 |
Source: Traffic |
Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49733 -> 77.91.77.66:58709 |
Source: Traffic |
Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49735 |
Source: Traffic |
Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49735 -> 77.91.77.66:58709 |
Source: Traffic |
Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49741 |
Source: Traffic |
Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49741 -> 77.91.77.66:58709 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: AlCsIOd0pd.exe, 00000000.00000003.1748570602.0000000000CD0000.00000004.00001000.00020000.00000000.sdmp, AlCsIOd0pd.exe, 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000003.1783897542.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1784572733.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3251444322.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1896625468.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1976471958.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3251481803.000000000055D000.00000002.00000001.01000000.00000005.sdmp |
String found in binary or memory: http://www.winimage.com/zLibDll |
Source: MPGPH131.exe |
String found in binary or memory: https://ipinfo.io/ |
Source: AlCsIOd0pd.exe, 00000000.00000003.1748570602.0000000000CD0000.00000004.00001000.00020000.00000000.sdmp, AlCsIOd0pd.exe, 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000003.1783897542.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1784572733.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3251444322.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1896625468.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1976471958.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3251481803.000000000055D000.00000002.00000001.01000000.00000005.sdmp |
String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll |
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3255069543.0000000000CED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.3253912060.0000000000C37000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3253787477.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3253822490.0000000000E38000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORT |
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORTB |
Source: RageMP131.exe, 00000007.00000002.3253787477.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORTX |
Source: MPGPH131.exe, 00000006.00000002.3253912060.0000000000C37000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORToE |
Source: MPGPH131.exe |
String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address |
Source: AlCsIOd0pd.exe |
Static PE information: section name: |
Source: AlCsIOd0pd.exe |
Static PE information: section name: |
Source: AlCsIOd0pd.exe |
Static PE information: section name: |
Source: AlCsIOd0pd.exe |
Static PE information: section name: |
Source: RageMP131.exe.0.dr |
Static PE information: section name: |
Source: RageMP131.exe.0.dr |
Static PE information: section name: |
Source: RageMP131.exe.0.dr |
Static PE information: section name: |
Source: RageMP131.exe.0.dr |
Static PE information: section name: |
Source: MPGPH131.exe.0.dr |
Static PE information: section name: |
Source: MPGPH131.exe.0.dr |
Static PE information: section name: |
Source: MPGPH131.exe.0.dr |
Static PE information: section name: |
Source: MPGPH131.exe.0.dr |
Static PE information: section name: |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_0043C960 |
0_2_0043C960 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_0043A928 |
0_2_0043A928 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_004371A0 |
0_2_004371A0 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_0044DA86 |
0_2_0044DA86 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_0044036F |
0_2_0044036F |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_00458BB0 |
0_2_00458BB0 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_004EFC40 |
0_2_004EFC40 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_0042F580 |
0_2_0042F580 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_00452610 |
0_2_00452610 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_004F2FD0 |
0_2_004F2FD0 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_004547BF |
0_2_004547BF |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0043C960 |
5_2_0043C960 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0043A928 |
5_2_0043A928 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004371A0 |
5_2_004371A0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0044DA86 |
5_2_0044DA86 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0044036F |
5_2_0044036F |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00458BB0 |
5_2_00458BB0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004EFC40 |
5_2_004EFC40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0042F580 |
5_2_0042F580 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00452610 |
5_2_00452610 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004F2FD0 |
5_2_004F2FD0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004547BF |
5_2_004547BF |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_0043C960 |
6_2_0043C960 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_0043A928 |
6_2_0043A928 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_004371A0 |
6_2_004371A0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_0044DA86 |
6_2_0044DA86 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_0044036F |
6_2_0044036F |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_00458BB0 |
6_2_00458BB0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_004EFC40 |
6_2_004EFC40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_0042F580 |
6_2_0042F580 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_00452610 |
6_2_00452610 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_004F2FD0 |
6_2_004F2FD0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_004547BF |
6_2_004547BF |
Source: AlCsIOd0pd.exe |
Static PE information: Section: ZLIB complexity 0.9988486351431981 |
Source: AlCsIOd0pd.exe |
Static PE information: Section: ZLIB complexity 0.9942874765037594 |
Source: AlCsIOd0pd.exe |
Static PE information: Section: ZLIB complexity 0.98974609375 |
Source: AlCsIOd0pd.exe |
Static PE information: Section: .reloc ZLIB complexity 1.5 |
Source: RageMP131.exe.0.dr |
Static PE information: Section: ZLIB complexity 0.9988486351431981 |
Source: RageMP131.exe.0.dr |
Static PE information: Section: ZLIB complexity 0.9942874765037594 |
Source: RageMP131.exe.0.dr |
Static PE information: Section: ZLIB complexity 0.98974609375 |
Source: RageMP131.exe.0.dr |
Static PE information: Section: .reloc ZLIB complexity 1.5 |
Source: MPGPH131.exe.0.dr |
Static PE information: Section: ZLIB complexity 0.9988486351431981 |
Source: MPGPH131.exe.0.dr |
Static PE information: Section: ZLIB complexity 0.9942874765037594 |
Source: MPGPH131.exe.0.dr |
Static PE information: Section: ZLIB complexity 0.98974609375 |
Source: MPGPH131.exe.0.dr |
Static PE information: Section: .reloc ZLIB complexity 1.5 |
Source: AlCsIOd0pd.exe, 00000000.00000003.1748570602.0000000000CD0000.00000004.00001000.00020000.00000000.sdmp, AlCsIOd0pd.exe, 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000003.1783897542.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1784572733.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3251444322.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1896625468.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1976471958.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3251481803.000000000055D000.00000002.00000001.01000000.00000005.sdmp |
Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q); |
Source: AlCsIOd0pd.exe, 00000000.00000003.1748570602.0000000000CD0000.00000004.00001000.00020000.00000000.sdmp, AlCsIOd0pd.exe, 00000000.00000002.3251443342.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000003.1783897542.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3252220820.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.3251589290.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1784572733.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.3251444322.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1896625468.0000000002850000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1976471958.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.3251481803.000000000055D000.00000002.00000001.01000000.00000005.sdmp |
Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger'); |
Source: unknown |
Process created: C:\Users\user\Desktop\AlCsIOd0pd.exe "C:\Users\user\Desktop\AlCsIOd0pd.exe" |
|
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST |
|
Source: C:\Windows\SysWOW64\schtasks.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST |
|
Source: C:\Windows\SysWOW64\schtasks.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: unknown |
Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe |
|
Source: unknown |
Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe |
|
Source: unknown |
Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" |
|
Source: unknown |
Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" |
|
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: xmllite.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: xmllite.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: AlCsIOd0pd.exe |
Static PE information: section name: |
Source: AlCsIOd0pd.exe |
Static PE information: section name: |
Source: AlCsIOd0pd.exe |
Static PE information: section name: |
Source: AlCsIOd0pd.exe |
Static PE information: section name: |
Source: AlCsIOd0pd.exe |
Static PE information: section name: .themida |
Source: AlCsIOd0pd.exe |
Static PE information: section name: .boot |
Source: RageMP131.exe.0.dr |
Static PE information: section name: |
Source: RageMP131.exe.0.dr |
Static PE information: section name: |
Source: RageMP131.exe.0.dr |
Static PE information: section name: |
Source: RageMP131.exe.0.dr |
Static PE information: section name: |
Source: RageMP131.exe.0.dr |
Static PE information: section name: .themida |
Source: RageMP131.exe.0.dr |
Static PE information: section name: .boot |
Source: MPGPH131.exe.0.dr |
Static PE information: section name: |
Source: MPGPH131.exe.0.dr |
Static PE information: section name: |
Source: MPGPH131.exe.0.dr |
Static PE information: section name: |
Source: MPGPH131.exe.0.dr |
Static PE information: section name: |
Source: MPGPH131.exe.0.dr |
Static PE information: section name: .themida |
Source: MPGPH131.exe.0.dr |
Static PE information: section name: .boot |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_00598B86 push 677583F0h; mov dword ptr [esp], ecx |
0_2_00873ADB |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_00598B86 push edx; mov dword ptr [esp], 7E9A49CCh |
0_2_00873B0A |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_00598B86 push 0EDD01E1h; mov dword ptr [esp], ecx |
0_2_00873B1D |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_00433F59 push ecx; ret |
0_2_00433F6C |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00598B86 push 677583F0h; mov dword ptr [esp], ecx |
5_2_00873ADB |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00598B86 push edx; mov dword ptr [esp], 7E9A49CCh |
5_2_00873B0A |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00598B86 push 0EDD01E1h; mov dword ptr [esp], ecx |
5_2_00873B1D |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00433F59 push ecx; ret |
5_2_00433F6C |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_00598B86 push 677583F0h; mov dword ptr [esp], ecx |
6_2_00873ADB |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_00598B86 push edx; mov dword ptr [esp], 7E9A49CCh |
6_2_00873B0A |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_00598B86 push 0EDD01E1h; mov dword ptr [esp], ecx |
6_2_00873B1D |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_00433F59 push ecx; ret |
6_2_00433F6C |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe TID: 3084 |
Thread sleep count: 3495 > 30 |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe TID: 3084 |
Thread sleep time: -352995s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe TID: 3084 |
Thread sleep count: 6379 > 30 |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe TID: 3084 |
Thread sleep time: -644279s >= -30000s |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1376 |
Thread sleep count: 78 > 30 |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1376 |
Thread sleep count: 9806 > 30 |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1376 |
Thread sleep time: -990406s >= -30000s |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5436 |
Thread sleep count: 74 > 30 |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5436 |
Thread sleep count: 9807 > 30 |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5436 |
Thread sleep time: -990507s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1896 |
Thread sleep count: 101 > 30 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1896 |
Thread sleep count: 9782 > 30 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1896 |
Thread sleep time: -987982s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 4520 |
Thread sleep count: 9885 > 30 |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 4520 |
Thread sleep time: -998385s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Last function: Thread delayed |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Last function: Thread delayed |
Source: C:\Windows\System32\conhost.exe |
Last function: Thread delayed |
Source: C:\Windows\System32\conhost.exe |
Last function: Thread delayed |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Last function: Thread delayed |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Last function: Thread delayed |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Last function: Thread delayed |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Last function: Thread delayed |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Last function: Thread delayed |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Last function: Thread delayed |
Source: AlCsIOd0pd.exe, 00000000.00000003.1768008425.0000000000D81000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}| |
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D81000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}i |
Source: RageMP131.exe, 0000000B.00000002.3253822490.0000000000E30000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000& |
Source: MPGPH131.exe, 00000006.00000002.3253912060.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU |
Source: MPGPH131.exe, 00000005.00000002.3255069543.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}@_ |
Source: MPGPH131.exe, 00000006.00000002.3253912060.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}M81 |
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D6A000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}-K |
Source: RageMP131.exe, 0000000B.00000003.1988485374.0000000000E97000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: MPGPH131.exe, 00000005.00000002.3255069543.0000000000CED000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&m |
Source: AlCsIOd0pd.exe, 00000000.00000003.1768008425.0000000000D81000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}] |
Source: RageMP131.exe, 00000007.00000002.3253787477.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__orpo |
Source: MPGPH131.exe, 00000005.00000002.3255069543.0000000000CED000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}t #7NVD slot #7 |
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D6A000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000% |
Source: RageMP131.exe, 00000007.00000002.3253787477.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4 |
Source: MPGPH131.exe, 00000006.00000002.3253912060.0000000000C56000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}>jD |
Source: RageMP131.exe, 00000007.00000002.3253787477.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}yj |
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_BEB2C06B |
Source: MPGPH131.exe, 00000005.00000003.1808009410.0000000000D51000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}O |
Source: RageMP131.exe, 0000000B.00000003.1988485374.0000000000E97000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: RageMP131.exe, 0000000B.00000002.3253822490.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll= |
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}NVD slot #44NVD slot #44 |
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} slot #34 |
Source: AlCsIOd0pd.exe, 00000000.00000002.3253969387.0000000000D6A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.3255069543.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
0_2_00438A64 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
0_2_0043451D |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
5_2_00438A64 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
5_2_0043451D |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
6_2_00438A64 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
6_2_0043451D |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: 0_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject, |
0_2_004CF280 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject, |
5_2_004CF280 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 6_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject, |
6_2_004CF280 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: GetLocaleInfoW, |
0_2_004531CA |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: EnumSystemLocalesW, |
0_2_0044B1B1 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, |
0_2_004532F3 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: GetACP,IsValidCodePage,GetLocaleInfoW, |
0_2_00452B5A |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: GetLocaleInfoW, |
0_2_004533F9 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, |
0_2_004534CF |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: GetLocaleInfoW, |
0_2_00452D5F |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: EnumSystemLocalesW, |
0_2_00452E51 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: EnumSystemLocalesW, |
0_2_00452E06 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: EnumSystemLocalesW, |
0_2_00452EEC |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, |
0_2_00452F77 |
Source: C:\Users\user\Desktop\AlCsIOd0pd.exe |
Code function: GetLocaleInfoW, |
0_2_0044B734 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
5_2_004531CA |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
5_2_0044B1B1 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, |
5_2_004532F3 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetACP,IsValidCodePage,GetLocaleInfoW, |
5_2_00452B5A |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
5_2_004533F9 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, |
5_2_004534CF |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
5_2_00452D5F |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
5_2_00452E51 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
5_2_00452E06 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
5_2_00452EEC |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, |
5_2_00452F77 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
5_2_0044B734 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
6_2_004531CA |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
6_2_0044B1B1 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, |
6_2_004532F3 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetACP,IsValidCodePage,GetLocaleInfoW, |
6_2_00452B5A |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
6_2_004533F9 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, |
6_2_004534CF |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
6_2_00452D5F |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
6_2_00452E51 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
6_2_00452E06 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
6_2_00452EEC |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, |
6_2_00452F77 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
6_2_0044B734 |