Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004C6000 FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
0_2_004C6000 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
0_2_00432022 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error, |
0_2_004E6770 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError, |
0_2_00431F9C |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
14_2_004C6000 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error, |
14_2_004E6770 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA, |
14_2_00493F40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, |
14_2_004DFF00 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00431F9C FindClose,FindFirstFileExW,GetLastError, |
14_2_00431F9C |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
14_2_00432022 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
14_2_004938D0 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/go.exe |
Source: MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/go.exeE |
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/go.exep |
Source: file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/lenin.exe |
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/lenin.exen |
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/mine/amadka.exe |
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/mine/amadka.exerisepro3J |
Source: Amcache.hve.21.dr |
String found in binary or memory: http://upx.sf.net |
Source: file.exe, 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1252876306.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1294004431.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000F.00000003.1294088860.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1408057987.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000011.00000003.1419406208.0000000002860000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1530238789.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000016.00000003.1503411648.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596034104.000000000055D000.00000002.00000001.01000000.00000007.sdmp |
String found in binary or memory: http://www.winimage.com/zLibDll |
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr |
String found in binary or memory: https://ac.ecosia.org/autocomplete?q= |
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr |
String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q= |
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr |
String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search |
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr |
String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command= |
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/ |
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33 |
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33Ap |
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33K |
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33SE |
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33i |
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33z |
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/n |
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/w |
Source: file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000E68000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33 |
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33J |
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33r |
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr |
String found in binary or memory: https://duckduckgo.com/ac/?q= |
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr |
String found in binary or memory: https://duckduckgo.com/chrome_newtab |
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr |
String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q= |
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000E92000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/ |
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D1F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/& |
Source: file.exe, 00000000.00000002.1408683703.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/Mozilla/5.0 |
Source: file.exe, 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1252876306.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1294004431.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000F.00000003.1294088860.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1408057987.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000011.00000003.1419406208.0000000002860000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1530238789.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000016.00000003.1503411648.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596034104.000000000055D000.00000002.00000001.01000000.00000007.sdmp |
String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll |
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E1A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000E68000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33 |
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.335 |
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33o |
Source: file.exe, 00000000.00000002.1408683703.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33s |
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000E81000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/y |
Source: file.exe, 00000000.00000002.1408683703.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33 |
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33% |
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000E68000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33h |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://support.mozilla.org |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK |
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t._ |
Source: file.exe, 00000000.00000002.1408683703.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649769976.0000000005796000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000E68000.00000004.00000020.00020000.00000000.sdmp, EfSAyduNP94O7VkIcUcjXr_.zip.14.dr |
String found in binary or memory: https://t.me/RiseProSUPPORT |
Source: MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORT- |
Source: MPGPH131.exe, 0000000E.00000002.1649769976.0000000005796000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORTMP=C: |
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORTOCESSOR_IDENTIFIER=Intel%q |
Source: MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORTv |
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro |
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.14.dr |
String found in binary or memory: https://t.me/risepro_bot |
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_bot33 |
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botB |
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botL |
Source: file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botO |
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botZ |
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botisepro_bot |
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botq |
Source: MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.y |
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr |
String found in binary or memory: https://www.ecosia.org/newtab/ |
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr |
String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico |
Source: file.exe, MPGPH131.exe |
String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW |
Source: MPGPH131.exe, 0000000E.00000002.1649769976.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1419793250.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1423274122.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ |
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/g |
Source: MPGPH131.exe, 0000000E.00000003.1420362412.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649769976.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1419793250.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1423274122.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.14.dr, D87fZN3R3jFeplaces.sqlite.15.dr, D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig |
Source: MPGPH131.exe, 0000000E.00000003.1420362412.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649769976.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1419793250.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000E8B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1423274122.00000000057A1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/ |
Source: MPGPH131.exe, 0000000E.00000002.1649769976.00000000057A1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/# |
Source: MPGPH131.exe, 0000000E.00000003.1420362412.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649769976.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1419793250.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1423274122.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.14.dr, D87fZN3R3jFeplaces.sqlite.15.dr, D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www. |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0049F0D0 |
0_2_0049F0D0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004AA200 |
0_2_004AA200 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0049D3A0 |
0_2_0049D3A0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0053F550 |
0_2_0053F550 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004FAD00 |
0_2_004FAD00 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0049AF60 |
0_2_0049AF60 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0043C960 |
0_2_0043C960 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0043A928 |
0_2_0043A928 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004371A0 |
0_2_004371A0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0044036F |
0_2_0044036F |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004A4320 |
0_2_004A4320 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00458BB0 |
0_2_00458BB0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004963B0 |
0_2_004963B0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004EEC40 |
0_2_004EEC40 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004EFC40 |
0_2_004EFC40 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00534D40 |
0_2_00534D40 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00546D20 |
0_2_00546D20 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00545DE0 |
0_2_00545DE0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0042F580 |
0_2_0042F580 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00452610 |
0_2_00452610 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004A3610 |
0_2_004A3610 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00458E30 |
0_2_00458E30 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004986B0 |
0_2_004986B0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00547760 |
0_2_00547760 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004F2FD0 |
0_2_004F2FD0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004E77E0 |
0_2_004E77E0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_0044002D |
14_2_0044002D |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004DF030 |
14_2_004DF030 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_0049F0D0 |
14_2_0049F0D0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004AA200 |
14_2_004AA200 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_0049D3A0 |
14_2_0049D3A0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004963B0 |
14_2_004963B0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00490440 |
14_2_00490440 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004DE430 |
14_2_004DE430 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_0053F550 |
14_2_0053F550 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004D7600 |
14_2_004D7600 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004986B0 |
14_2_004986B0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_0040B8E0 |
14_2_0040B8E0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00481C10 |
14_2_00481C10 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004FAD00 |
14_2_004FAD00 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00493F40 |
14_2_00493F40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_0049AF60 |
14_2_0049AF60 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004DFF00 |
14_2_004DFF00 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00493080 |
14_2_00493080 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004371A0 |
14_2_004371A0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_0044036F |
14_2_0044036F |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004A4320 |
14_2_004A4320 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004845E0 |
14_2_004845E0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_0042F580 |
14_2_0042F580 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004A3610 |
14_2_004A3610 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_005486C0 |
14_2_005486C0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00547760 |
14_2_00547760 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004E77E0 |
14_2_004E77E0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004547BF |
14_2_004547BF |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_0043C960 |
14_2_0043C960 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_0043A928 |
14_2_0043A928 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_0044DA86 |
14_2_0044DA86 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00458BB0 |
14_2_00458BB0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004EEC40 |
14_2_004EEC40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004EFC40 |
14_2_004EFC40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00534D40 |
14_2_00534D40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00546D20 |
14_2_00546D20 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00545DE0 |
14_2_00545DE0 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00458E30 |
14_2_00458E30 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00541F00 |
14_2_00541F00 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004F2FD0 |
14_2_004F2FD0 |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: vaultcli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: xmllite.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: xmllite.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: vaultcli.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: vaultcli.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rstrtmgr.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncrypt.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ntasn1.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d11.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxgi.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: resourcepolicyclient.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: kernel.appcore.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d10warp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: uxtheme.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxcore.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winhttp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: wininet.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mswsock.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: devobj.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ondemandconnroutehelper.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: webio.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: iphlpapi.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winnsi.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dnsapi.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rasadhlp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: fwpuclnt.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: schannel.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mskeyprotect.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncryptsslp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: msasn1.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: cryptsp.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rsaenh.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: cryptbase.dll |
|
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: gpapi.dll |
|
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004C6000 FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
0_2_004C6000 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
0_2_00432022 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error, |
0_2_004E6770 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError, |
0_2_00431F9C |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
14_2_004C6000 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error, |
14_2_004E6770 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA, |
14_2_00493F40 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, |
14_2_004DFF00 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00431F9C FindClose,FindFirstFileExW,GetLastError, |
14_2_00431F9C |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
14_2_00432022 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: 14_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
14_2_004938D0 |
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: SCSI\Dk&Ven_VMware&P |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: netportal.hdfcbank.comVMware20,11696492231 |
Source: file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWen-GBn |
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D35000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWh |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: secure.bankofamerica.comVMware20,11696 |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: ra Change Transaction PasswordVMware20,11696492231 |
Source: MPGPH131.exe, 0000000E.00000002.1649901501.0000000005BC5000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}}C |
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D35000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000& |
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000E9D000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&NE |
Source: Amcache.hve.21.dr |
Binary or memory string: vmci.sys |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: global block list test formVMware20,11696492231 |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: bankofamerica.comVMware20,11696492231x |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: comVMware20,11696492231o |
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E1A000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWXn |
Source: Amcache.hve.21.dr |
Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk |
Source: Amcache.hve.21.dr |
Binary or memory string: VMware PCI VMCI Bus Device |
Source: Amcache.hve.21.dr |
Binary or memory string: VMware Virtual RAM |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: HARtive Brokers - non-EU EuropeVMware20,11696492231 |
Source: Amcache.hve.21.dr |
Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1 |
Source: Amcache.hve.21.dr |
Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: turbotax.intuit.comVMware20,11696492231t |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: Interactive Brokers - HKVMware20,11696492231] |
Source: MPGPH131.exe, 0000000E.00000002.1649769976.00000000057A1000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_9C3F3566 |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p |
Source: Amcache.hve.21.dr |
Binary or memory string: VMware Virtual USB Mouse |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: interactivebrokers.co.inVMware20,11696492231d |
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: tive Brokers - non-EU EuropeVMware20,11696492231 |
Source: RageMP131.exe, 00000016.00000003.1528744564.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231 |
Source: Amcache.hve.21.dr |
Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys |
Source: MPGPH131.exe, 0000000E.00000002.1649769976.0000000005760000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}L~ |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231 |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231 |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: formVMware20,11696492231 |
Source: Amcache.hve.21.dr |
Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: outlook.office.comVMware20,11696492 |
Source: file.exe, 00000000.00000002.1408683703.0000000000F70000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000g |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: r global passwords blocklistVMware20,11696492231 |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: www.interactivebrokers.comVMware20,11696492231} |
Source: Amcache.hve.21.dr |
Binary or memory string: vmci.syshbin` |
Source: Amcache.hve.21.dr |
Binary or memory string: \driver\vmci,\driver\pci |
Source: file.exe, 00000000.00000002.1408683703.0000000000F70000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000@Z |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: trackpan.utiitsl.comVMware20,1169649223 |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: CT service, encrypted_token FROM token_servicerr global passwords blocklistVMware20,11696492231 |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: secure.bankofamerica.comVMware20,11696492231|UE |
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&)8: |
Source: Amcache.hve.21.dr |
Binary or memory string: VMware |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n |
Source: MPGPH131.exe, 0000000E.00000002.1649769976.0000000005760000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\User Data\bmikpgodpkclnkgmnpphehdgcimmided\CURRENT}z. |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: Canara Transaction PasswordVMware20,11696492231} |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: o.inVMware20,11696492231~ |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: outlook.office.comVMware20,11696492231s |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: AMC password management pageVMware20,11696492231 |
Source: Amcache.hve.21.dr |
Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: pageformVMware20,11696492231 |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: interactivebrokers.comVMware20,11696492231 |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x |
Source: file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000E9D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW |
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}qE |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^ |
Source: RageMP131.exe, 00000016.00000003.1528744564.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: outlook.office365.comVMware20,11696492231t |
Source: Amcache.hve.21.dr |
Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: discord.comVMware20,11696492231f |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~ |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: tasks.office.comVMware20,11696492231o |
Source: Amcache.hve.21.dr |
Binary or memory string: VMware20,1 |
Source: Amcache.hve.21.dr |
Binary or memory string: Microsoft Hyper-V Generation Counter |
Source: Amcache.hve.21.dr |
Binary or memory string: NECVMWar VMware SATA CD00 |
Source: Amcache.hve.21.dr |
Binary or memory string: VMware Virtual disk SCSI Disk Device |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: account.microsoft.com/profileVMware20,11696492231u |
Source: Amcache.hve.21.dr |
Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231 |
Source: Amcache.hve.21.dr |
Binary or memory string: VMware VMCI Bus Device |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231 |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: Canara Transaction PasswordVMware20,11696492231x |
Source: Amcache.hve.21.dr |
Binary or memory string: vmci.inf_amd64_68ed49469341f563 |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Interactive Brokers - GDCDYNVMware20,116( |
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWen-GBnIA |
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E1A000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000& |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: ccount.microsoft.com/profileVMware20,11696492231u |
Source: Amcache.hve.21.dr |
Binary or memory string: vmci.syshbin |
Source: Amcache.hve.21.dr |
Binary or memory string: VMware, Inc. |
Source: Amcache.hve.21.dr |
Binary or memory string: VMware20,1hbin@ |
Source: Amcache.hve.21.dr |
Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563 |
Source: Amcache.hve.21.dr |
Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: file.exe, 00000000.00000002.1408683703.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW( |
Source: MPGPH131.exe, 0000000E.00000002.1649769976.0000000005760000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\User Data\igkpcodhieompeloncfnbekccinhapdb\CURRENT |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z |
Source: Amcache.hve.21.dr |
Binary or memory string: c:/windows/system32/drivers/vmci.sys |
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: rootpagecomVMware20,11696492231o |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: dev.azure.comVMware20,11696492231j |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h |
Source: Amcache.hve.21.dr |
Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: Amcache.hve.21.dr |
Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom |
Source: MBy5KfxI1GpwWeb Data.14.dr |
Binary or memory string: ms.portal.azure.comVMware20,11696492231 |
Source: MPGPH131.exe, 0000000E.00000003.1320967567.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}mD |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetLocaleInfoW, |
0_2_004531CA |
Source: C:\Users\user\Desktop\file.exe |
Code function: EnumSystemLocalesW, |
0_2_0044B1B1 |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, |
0_2_004532F3 |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetACP,IsValidCodePage,GetLocaleInfoW, |
0_2_00452B5A |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetLocaleInfoW, |
0_2_004533F9 |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, |
0_2_004534CF |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetLocaleInfoW, |
0_2_00452D5F |
Source: C:\Users\user\Desktop\file.exe |
Code function: EnumSystemLocalesW, |
0_2_00452E51 |
Source: C:\Users\user\Desktop\file.exe |
Code function: EnumSystemLocalesW, |
0_2_00452E06 |
Source: C:\Users\user\Desktop\file.exe |
Code function: EnumSystemLocalesW, |
0_2_00452EEC |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, |
0_2_00452F77 |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetLocaleInfoW, |
0_2_0044B734 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, |
14_2_004DFF00 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
14_2_004531CA |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
14_2_0044B1B1 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, |
14_2_004532F3 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
14_2_004533F9 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, |
14_2_004534CF |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
14_2_0044B734 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetACP,IsValidCodePage,GetLocaleInfoW, |
14_2_00452B5A |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW, |
14_2_00452D5F |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
14_2_00452E51 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
14_2_00452E06 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: EnumSystemLocalesW, |
14_2_00452EEC |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, |
14_2_00452F77 |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\formhistory.sqlite |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\logins.json |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\signons.sqlite |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\places.sqlite |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\signons.sqlite |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT |
Jump to behavior |