Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
0_2_004C6000 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error, |
0_2_004E6770 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree, |
0_2_00493F40 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, |
0_2_004DFF00 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError, |
0_2_00431F9C |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
0_2_00432022 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
0_2_004938D0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
5_2_004C6000 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error, |
5_2_004E6770 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree, |
5_2_00493F40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, |
5_2_004DFF00 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00431F9C FindClose,FindFirstFileExW,GetLastError, |
5_2_00431F9C |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
5_2_00432022 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
5_2_004938D0 |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1939291540.00000000056BD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1952431025.00000000057FD000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/go.exe |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/go.exeP |
Source: plTAoSCew2.exe, 00000000.00000002.1966229091.0000000005825000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1760783961.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1759698387.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/lenin.exe |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/lenin.exe00.1 |
Source: plTAoSCew2.exe, 00000000.00000002.1966229091.0000000005825000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1760783961.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1759698387.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/lenin.exe963 |
Source: MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/lenin.exeisepro_bot |
Source: MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/mine/amadka.exe |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/mine/amadka.exe.1 |
Source: MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://microsoft.co |
Source: Amcache.hve.9.dr |
String found in binary or memory: http://upx.sf.net |
Source: plTAoSCew2.exe, 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmp, plTAoSCew2.exe, 00000000.00000003.1666366479.00000000028B0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938053535.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1698887764.00000000028D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1699835133.00000000028E0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1950317365.000000000055D000.00000002.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000A.00000002.1885484407.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000000A.00000003.1809231647.0000000000F30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1978107084.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000011.00000003.1889498144.0000000000F10000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: http://www.winimage.com/zLibDll |
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr |
String found in binary or memory: https://ac.ecosia.org/autocomplete?q= |
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr |
String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q= |
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr |
String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search |
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr |
String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command= |
Source: MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.000000000106F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/ |
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/6 |
Source: RageMP131.exe, 0000000A.00000002.1886588221.0000000001030000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001065000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33 |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33U |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33XB |
Source: RageMP131.exe, 0000000A.00000002.1886588221.0000000001030000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33tA |
Source: MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/i |
Source: MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/u |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/z |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33 |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001030000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33J |
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr |
String found in binary or memory: https://duckduckgo.com/ac/?q= |
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr |
String found in binary or memory: https://duckduckgo.com/chrome_newtab |
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr |
String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q= |
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001010000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.000000000104D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/ |
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001041000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/Grr |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000DE5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951132632.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001026000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.000000000104D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/Mozilla/5.0 |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/Wp |
Source: plTAoSCew2.exe, 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmp, plTAoSCew2.exe, 00000000.00000003.1666366479.00000000028B0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938053535.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1698887764.00000000028D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1699835133.00000000028E0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1950317365.000000000055D000.00000002.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000A.00000002.1885484407.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000000A.00000003.1809231647.0000000000F30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1978107084.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000011.00000003.1889498144.0000000000F10000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/p |
Source: MPGPH131.exe, 00000006.00000002.1951132632.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/t |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951132632.0000000000CDF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.000000000102E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33 |
Source: MPGPH131.exe, 00000006.00000002.1951132632.0000000000C97000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33P |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33V0 |
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33e |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33o |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000DE5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951132632.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001026000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.000000000104D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33 |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://support.mozilla.org |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF |
Source: plTAoSCew2.exe, 00000000.00000003.1746011314.0000000005817000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1748770290.0000000005838000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775059834.0000000005700000.00000004.00000020.00020000.00000000.sdmp, tJraVEZ3gCYZHistory.5.dr, JaptwNSGRKkjHistory.0.dr, BXcENIBcAk_THistory.5.dr, x2c20gF0jhVeHistory.0.dr |
String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016 |
Source: tJraVEZ3gCYZHistory.5.dr, JaptwNSGRKkjHistory.0.dr, BXcENIBcAk_THistory.5.dr, x2c20gF0jhVeHistory.0.dr |
String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples |
Source: plTAoSCew2.exe, 00000000.00000003.1746011314.0000000005817000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1748770290.0000000005838000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775059834.0000000005700000.00000004.00000020.00020000.00000000.sdmp, tJraVEZ3gCYZHistory.5.dr, JaptwNSGRKkjHistory.0.dr, BXcENIBcAk_THistory.5.dr, x2c20gF0jhVeHistory.0.dr |
String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17 |
Source: tJraVEZ3gCYZHistory.5.dr, JaptwNSGRKkjHistory.0.dr, BXcENIBcAk_THistory.5.dr, x2c20gF0jhVeHistory.0.dr |
String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.5F |
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.H |
Source: MPGPH131.exe, 00000006.00000002.1951132632.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, RRyR9q5fccm7OnjvPC2dXYR.zip.5.dr, i6XbcxN8dLmuU_sWPwGcEWP.zip.0.dr |
String found in binary or memory: https://t.me/RiseProSUPPORT |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORT-n |
Source: MPGPH131.exe, 00000005.00000002.1939291540.000000000568C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORT4 |
Source: plTAoSCew2.exe, 00000000.00000002.1966042254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791524447.00000000057EE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORTZ |
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro |
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.5.dr, passwords.txt.0.dr |
String found in binary or memory: https://t.me/risepro_bot |
Source: MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_bot.46.123.33 |
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botJ |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botQB |
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botX |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001030000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botisepro_bot |
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr |
String found in binary or memory: https://www.ecosia.org/newtab/ |
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr |
String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico |
Source: plTAoSCew2.exe, MPGPH131.exe |
String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2 |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR |
Source: plTAoSCew2.exe, 00000000.00000002.1966229091.0000000005825000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1758383046.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1760783961.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1759698387.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1952431025.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ |
Source: plTAoSCew2.exe, 00000000.00000002.1966229091.0000000005825000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1758383046.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1760783961.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1759698387.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/EH |
Source: plTAoSCew2.exe, 00000000.00000003.1748032372.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745823071.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000002.1966042254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1746837254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791524447.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747439986.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1773502573.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1773782077.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1939291540.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769017495.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771529992.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1772016615.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.5.dr, 3b6N2Xdh3CYwplaces.sqlite.5.dr, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig |
Source: plTAoSCew2.exe, 00000000.00000002.1966229091.0000000005825000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1758383046.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1760783961.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1759698387.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1952431025.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/ |
Source: plTAoSCew2.exe, 00000000.00000003.1748032372.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745823071.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000002.1966042254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1746837254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791524447.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747439986.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1773502573.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1773782077.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1939291540.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769017495.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771529992.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1772016615.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1952431025.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771375415.0000000005812000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.5.dr, 3b6N2Xdh3CYwplaces.sqlite.5.dr, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www. |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/r |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox |
Source: MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/refoxe |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/refoxmChE5 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_0044002D |
0_2_0044002D |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004DF030 |
0_2_004DF030 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_0049F0D0 |
0_2_0049F0D0 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004AA200 |
0_2_004AA200 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_0049D3A0 |
0_2_0049D3A0 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004963B0 |
0_2_004963B0 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00490440 |
0_2_00490440 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004DE430 |
0_2_004DE430 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_0053F550 |
0_2_0053F550 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004D7600 |
0_2_004D7600 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004986B0 |
0_2_004986B0 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_0040B8E0 |
0_2_0040B8E0 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00481C10 |
0_2_00481C10 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004FAD00 |
0_2_004FAD00 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00493F40 |
0_2_00493F40 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_0049AF60 |
0_2_0049AF60 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004DFF00 |
0_2_004DFF00 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00493080 |
0_2_00493080 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004371A0 |
0_2_004371A0 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_0044036F |
0_2_0044036F |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004A4320 |
0_2_004A4320 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004845E0 |
0_2_004845E0 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_0042F580 |
0_2_0042F580 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004A3610 |
0_2_004A3610 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_005486C0 |
0_2_005486C0 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00547760 |
0_2_00547760 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004E77E0 |
0_2_004E77E0 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004547BF |
0_2_004547BF |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_0043C960 |
0_2_0043C960 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_0043A928 |
0_2_0043A928 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_0044DA86 |
0_2_0044DA86 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00458BB0 |
0_2_00458BB0 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004EEC40 |
0_2_004EEC40 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004EFC40 |
0_2_004EFC40 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00534D40 |
0_2_00534D40 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00546D20 |
0_2_00546D20 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00545DE0 |
0_2_00545DE0 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00458E30 |
0_2_00458E30 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00541F00 |
0_2_00541F00 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004F2FD0 |
0_2_004F2FD0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0044002D |
5_2_0044002D |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004DF030 |
5_2_004DF030 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0049F0D0 |
5_2_0049F0D0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004AA200 |
5_2_004AA200 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0049D3A0 |
5_2_0049D3A0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004963B0 |
5_2_004963B0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00490440 |
5_2_00490440 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004DE430 |
5_2_004DE430 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0053F550 |
5_2_0053F550 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004D7600 |
5_2_004D7600 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004986B0 |
5_2_004986B0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0040B8E0 |
5_2_0040B8E0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00481C10 |
5_2_00481C10 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004FAD00 |
5_2_004FAD00 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00493F40 |
5_2_00493F40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0049AF60 |
5_2_0049AF60 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004DFF00 |
5_2_004DFF00 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00493080 |
5_2_00493080 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004371A0 |
5_2_004371A0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0044036F |
5_2_0044036F |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004A4320 |
5_2_004A4320 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004845E0 |
5_2_004845E0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0042F580 |
5_2_0042F580 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004A3610 |
5_2_004A3610 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_005486C0 |
5_2_005486C0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00547760 |
5_2_00547760 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004E77E0 |
5_2_004E77E0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004547BF |
5_2_004547BF |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0043C960 |
5_2_0043C960 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0043A928 |
5_2_0043A928 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_0044DA86 |
5_2_0044DA86 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00458BB0 |
5_2_00458BB0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004EEC40 |
5_2_004EEC40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004EFC40 |
5_2_004EFC40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00534D40 |
5_2_00534D40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00546D20 |
5_2_00546D20 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00545DE0 |
5_2_00545DE0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00458E30 |
5_2_00458E30 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00541F00 |
5_2_00541F00 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004F2FD0 |
5_2_004F2FD0 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: vaultcli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: xmllite.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: xmllite.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: vaultcli.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: vaultcli.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: apphelp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rstrtmgr.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncrypt.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ntasn1.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d11.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxgi.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: resourcepolicyclient.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: kernel.appcore.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d10warp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: uxtheme.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxcore.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winhttp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: wininet.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mswsock.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: devobj.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ondemandconnroutehelper.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: webio.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: iphlpapi.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winnsi.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dnsapi.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: fwpuclnt.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rasadhlp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: schannel.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mskeyprotect.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncryptsslp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: msasn1.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: cryptsp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rsaenh.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: cryptbase.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: gpapi.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rstrtmgr.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncrypt.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ntasn1.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d11.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxgi.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: resourcepolicyclient.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: kernel.appcore.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d10warp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: uxtheme.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxcore.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winhttp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: wininet.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mswsock.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: devobj.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ondemandconnroutehelper.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: webio.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: iphlpapi.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winnsi.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dnsapi.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rasadhlp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: fwpuclnt.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: schannel.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mskeyprotect.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncryptsslp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: msasn1.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: cryptsp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rsaenh.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: cryptbase.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: gpapi.dll |
|
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
0_2_004C6000 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error, |
0_2_004E6770 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree, |
0_2_00493F40 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, |
0_2_004DFF00 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError, |
0_2_00431F9C |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
0_2_00432022 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: 0_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
0_2_004938D0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
5_2_004C6000 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error, |
5_2_004E6770 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree, |
5_2_00493F40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, |
5_2_004DFF00 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00431F9C FindClose,FindFirstFileExW,GetLastError, |
5_2_00431F9C |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
5_2_00432022 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 5_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
5_2_004938D0 |
Source: MPGPH131.exe, 00000006.00000003.1787428377.0000000005818000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}J |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWfsZ |
Source: Amcache.hve.9.dr |
Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001030000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001020000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW |
Source: RageMP131.exe, 0000000A.00000002.1886588221.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWh |
Source: MPGPH131.exe, 00000005.00000002.1939291540.000000000568C000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_55C92DC3.oj |
Source: RageMP131.exe, 00000011.00000003.1901450002.0000000001039000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}J6HEdjEHUub5EtqTQ2dk3wwrCNfruTWZeEqONRrqgXAW0ke6pZXg==_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=*?h |
Source: Amcache.hve.9.dr |
Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev |
Source: MPGPH131.exe, 00000006.00000002.1951132632.0000000000CDF000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWHq |
Source: plTAoSCew2.exe, 00000000.00000002.1965989888.00000000057C0000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}+ |
Source: MPGPH131.exe, 00000006.00000002.1951132632.0000000000C90000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000& |
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001065000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW11 |
Source: Amcache.hve.9.dr |
Binary or memory string: vmci.sys |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}!? |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware20,1 |
Source: Amcache.hve.9.dr |
Binary or memory string: Microsoft Hyper-V Generation Counter |
Source: Amcache.hve.9.dr |
Binary or memory string: NECVMWar VMware SATA CD00 |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware Virtual disk SCSI Disk Device |
Source: Amcache.hve.9.dr |
Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk |
Source: Amcache.hve.9.dr |
Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware PCI VMCI Bus Device |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware VMCI Bus Device |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware Virtual RAM |
Source: Amcache.hve.9.dr |
Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1 |
Source: Amcache.hve.9.dr |
Binary or memory string: vmci.inf_amd64_68ed49469341f563 |
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000& |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware Virtual USB Mouse |
Source: RageMP131.exe, 0000000A.00000002.1886588221.000000000100B000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b |
Source: Amcache.hve.9.dr |
Binary or memory string: vmci.syshbin |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware, Inc. |
Source: RageMP131.exe, 00000011.00000003.1901450002.0000000001039000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: MPGPH131.exe, 00000005.00000003.1711785629.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}5> |
Source: MPGPH131.exe, 00000005.00000003.1786679262.00000000056DB000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\Public |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware20,1hbin@ |
Source: Amcache.hve.9.dr |
Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563 |
Source: Amcache.hve.9.dr |
Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys |
Source: MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW4 |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: _vmware |
Source: Amcache.hve.9.dr |
Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: Amcache.hve.9.dr |
Binary or memory string: c:/windows/system32/drivers/vmci.sys |
Source: Amcache.hve.9.dr |
Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \?\scsi_vmwaretual_dif219&0&3f563070-94f2-b8b}~ |
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F10000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&2g |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0 |
Source: Amcache.hve.9.dr |
Binary or memory string: vmci.syshbin` |
Source: Amcache.hve.9.dr |
Binary or memory string: \driver\vmci,\driver\pci |
Source: plTAoSCew2.exe, 00000000.00000002.1965989888.00000000057C0000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}! |
Source: plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_55C92DC3-J |
Source: Amcache.hve.9.dr |
Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: MPGPH131.exe, 00000006.00000003.1787428377.0000000005818000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_55C92DC3 |
Source: Amcache.hve.9.dr |
Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWH |
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWL |
Source: RageMP131.exe, 0000000A.00000003.1821753153.0000000001013000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}6 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, |
0_2_004DFF00 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: GetLocaleInfoW, |
0_2_004531CA |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: EnumSystemLocalesW, |
0_2_0044B1B1 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, |
0_2_004532F3 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: GetLocaleInfoW, |
0_2_004533F9 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, |
0_2_004534CF |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: GetLocaleInfoW, |
0_2_0044B734 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: GetACP,IsValidCodePage,GetLocaleInfoW, |
0_2_00452B5A |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: GetLocaleInfoW, |
0_2_00452D5F |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: EnumSystemLocalesW, |
0_2_00452E51 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: EnumSystemLocalesW, |
0_2_00452E06 |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: EnumSystemLocalesW, |
0_2_00452EEC |
Source: C:\Users\user\Desktop\plTAoSCew2.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, |
0_2_00452F77 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, |
5_2_004DFF00 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
5_2_004531CA |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
5_2_0044B1B1 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, |
5_2_004532F3 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
5_2_004533F9 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, |
5_2_004534CF |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
5_2_0044B734 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetACP,IsValidCodePage,GetLocaleInfoW, |
5_2_00452B5A |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
5_2_00452D5F |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
5_2_00452E51 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
5_2_00452E06 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
5_2_00452EEC |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, |
5_2_00452F77 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT |
Jump to behavior |