Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
0_2_004C6000 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error, |
0_2_004E6770 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree, |
0_2_00493F40 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, |
0_2_004DFF00 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError, |
0_2_00431F9C |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
0_2_00432022 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004E67A8 FindFirstFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError, |
0_2_004E67A8 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
0_2_004938D0 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 77.91.77.66 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/go.exe |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/lenin.exe |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/cost/lenin.exet |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://77.91.77.81/mine/amadka.exe |
Source: RageMP131.exe, 0000000B.00000002.4144884433.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.microsoft |
Source: Amcache.hve.15.dr |
String found in binary or memory: http://upx.sf.net |
Source: file.exe, 00000000.00000002.3555956165.000000000055D000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1675059249.0000000002990000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2474939313.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.4142206687.000000000055E000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.4142253887.000000000055E000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.2475489562.0000000002760000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2567545061.0000000000CE0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.4142172979.000000000055D000.00000002.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000C.00000003.2648323919.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000C.00000002.4142168146.000000000055D000.00000002.00000001.01000000.00000006.sdmp |
String found in binary or memory: http://www.winimage.com/zLibDll |
Source: file.exe, 00000000.00000003.3162088253.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3160353482.00000000057F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3159603527.00000000057D4000.00000004.00000020.00020000.00000000.sdmp, Tv5HrFbm6VQdWeb Data.0.dr, 5FkjBEcdJ5c0Web Data.0.dr, 4bB2RBXJ9t2XWeb Data.0.dr |
String found in binary or memory: https://ac.ecosia.org/autocomplete?q= |
Source: file.exe, 00000000.00000003.3162088253.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3160353482.00000000057F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3159603527.00000000057D4000.00000004.00000020.00020000.00000000.sdmp, Tv5HrFbm6VQdWeb Data.0.dr, 5FkjBEcdJ5c0Web Data.0.dr, 4bB2RBXJ9t2XWeb Data.0.dr |
String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q= |
Source: file.exe, 00000000.00000003.3162088253.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3160353482.00000000057F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3159603527.00000000057D4000.00000004.00000020.00020000.00000000.sdmp, Tv5HrFbm6VQdWeb Data.0.dr, 5FkjBEcdJ5c0Web Data.0.dr, 4bB2RBXJ9t2XWeb Data.0.dr |
String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search |
Source: file.exe, 00000000.00000003.3162088253.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3160353482.00000000057F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3159603527.00000000057D4000.00000004.00000020.00020000.00000000.sdmp, Tv5HrFbm6VQdWeb Data.0.dr, 5FkjBEcdJ5c0Web Data.0.dr, 4bB2RBXJ9t2XWeb Data.0.dr |
String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command= |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.4144884433.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000C.00000002.4144857009.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/ |
Source: RageMP131.exe, 0000000B.00000002.4144884433.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/5 |
Source: RageMP131.exe, 0000000B.00000002.4144884433.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/c |
Source: RageMP131.exe, 0000000C.00000002.4144857009.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33 |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33# |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.334C |
Source: RageMP131.exe, 0000000B.00000002.4144884433.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33C |
Source: RageMP131.exe, 0000000B.00000002.4144884433.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33ut |
Source: RageMP131.exe, 0000000B.00000002.4144884433.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/o |
Source: RageMP131.exe, 0000000C.00000002.4144857009.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33 |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33)W |
Source: RageMP131.exe, 0000000B.00000002.4144884433.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33E |
Source: file.exe, 00000000.00000003.3162088253.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3160353482.00000000057F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3159603527.00000000057D4000.00000004.00000020.00020000.00000000.sdmp, Tv5HrFbm6VQdWeb Data.0.dr, 5FkjBEcdJ5c0Web Data.0.dr, 4bB2RBXJ9t2XWeb Data.0.dr |
String found in binary or memory: https://duckduckgo.com/ac/?q= |
Source: file.exe, 00000000.00000003.3162088253.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3160353482.00000000057F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3159603527.00000000057D4000.00000004.00000020.00020000.00000000.sdmp, Tv5HrFbm6VQdWeb Data.0.dr, 5FkjBEcdJ5c0Web Data.0.dr, 4bB2RBXJ9t2XWeb Data.0.dr |
String found in binary or memory: https://duckduckgo.com/chrome_newtab |
Source: file.exe, 00000000.00000003.3162088253.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3160353482.00000000057F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3159603527.00000000057D4000.00000004.00000020.00020000.00000000.sdmp, Tv5HrFbm6VQdWeb Data.0.dr, 5FkjBEcdJ5c0Web Data.0.dr, 4bB2RBXJ9t2XWeb Data.0.dr |
String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q= |
Source: RageMP131.exe, 0000000C.00000002.4144857009.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000C.00000002.4144857009.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/ |
Source: file.exe, 00000000.00000002.3557114655.0000000000C96000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.4144884433.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000C.00000002.4144857009.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/Mozilla/5.0 |
Source: RageMP131.exe, 0000000C.00000002.4144857009.0000000000E70000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/N |
Source: file.exe, 00000000.00000002.3555956165.000000000055D000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1675059249.0000000002990000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2474939313.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.4142206687.000000000055E000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.4142253887.000000000055E000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.2475489562.0000000002760000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2567545061.0000000000CE0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.4142172979.000000000055D000.00000002.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000C.00000003.2648323919.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000C.00000002.4142168146.000000000055D000.00000002.00000001.01000000.00000006.sdmp |
String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll |
Source: file.exe, 00000000.00000002.3557114655.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/j |
Source: RageMP131.exe, 0000000B.00000002.4144884433.0000000000D61000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/t |
Source: file.exe, 00000000.00000002.3557114655.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.4144884433.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000C.00000002.4144857009.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000C.00000002.4144857009.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33 |
Source: RageMP131.exe, 0000000B.00000002.4144884433.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.335 |
Source: file.exe, 00000000.00000002.3557114655.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33: |
Source: file.exe, 00000000.00000002.3557114655.0000000000C96000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.4144884433.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000C.00000002.4144857009.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33 |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://support.mozilla.org |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF |
Source: file.exe, 00000000.00000003.3161576522.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, n7J29lEH1LkuHistory.0.dr, tpFa0VILO3AVHistory.0.dr |
String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016 |
Source: n7J29lEH1LkuHistory.0.dr, tpFa0VILO3AVHistory.0.dr |
String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples |
Source: file.exe, 00000000.00000003.3161576522.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, n7J29lEH1LkuHistory.0.dr, tpFa0VILO3AVHistory.0.dr |
String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17 |
Source: n7J29lEH1LkuHistory.0.dr, tpFa0VILO3AVHistory.0.dr |
String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install |
Source: file.exe, 00000000.00000002.3558548817.0000000005798000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3557114655.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.4144884433.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000C.00000002.4144857009.0000000000E37000.00000004.00000020.00020000.00000000.sdmp, 62AbnS8U76t4fChT49E_pCT.zip.0.dr |
String found in binary or memory: https://t.me/RiseProSUPPORT |
Source: RageMP131.exe, 0000000C.00000002.4144857009.0000000000E37000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORT$ |
Source: file.exe, 00000000.00000002.3558548817.0000000005798000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORT? |
Source: file.exe, 00000000.00000002.3557114655.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORTQ |
Source: RageMP131.exe, 0000000B.00000002.4144884433.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORTzo0u |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3165387841.0000000005836000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr |
String found in binary or memory: https://t.me/risepro_bot |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botiC |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botisepro_bot |
Source: file.exe, 00000000.00000003.3162088253.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3160353482.00000000057F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3159603527.00000000057D4000.00000004.00000020.00020000.00000000.sdmp, Tv5HrFbm6VQdWeb Data.0.dr, 5FkjBEcdJ5c0Web Data.0.dr, 4bB2RBXJ9t2XWeb Data.0.dr |
String found in binary or memory: https://www.ecosia.org/newtab/ |
Source: file.exe, 00000000.00000003.3162088253.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3160353482.00000000057F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3159603527.00000000057D4000.00000004.00000020.00020000.00000000.sdmp, Tv5HrFbm6VQdWeb Data.0.dr, 5FkjBEcdJ5c0Web Data.0.dr, 4bB2RBXJ9t2XWeb Data.0.dr |
String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico |
Source: MPGPH131.exe |
String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2 |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ |
Source: file.exe, 00000000.00000002.3558548817.0000000005787000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/V |
Source: D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/ |
Source: file.exe, 00000000.00000002.3558548817.0000000005787000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www. |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/r |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0044002D |
0_2_0044002D |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004DF030 |
0_2_004DF030 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0049F0D0 |
0_2_0049F0D0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004AA200 |
0_2_004AA200 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0049D3A0 |
0_2_0049D3A0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004963B0 |
0_2_004963B0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00490440 |
0_2_00490440 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004DE430 |
0_2_004DE430 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0053F550 |
0_2_0053F550 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004D7600 |
0_2_004D7600 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004986B0 |
0_2_004986B0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0040B8E0 |
0_2_0040B8E0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00481C10 |
0_2_00481C10 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004FAD00 |
0_2_004FAD00 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00493F40 |
0_2_00493F40 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0049AF60 |
0_2_0049AF60 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004DFF00 |
0_2_004DFF00 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00493080 |
0_2_00493080 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004371A0 |
0_2_004371A0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0044036F |
0_2_0044036F |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004A4320 |
0_2_004A4320 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004845E0 |
0_2_004845E0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0042F580 |
0_2_0042F580 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004A3610 |
0_2_004A3610 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_005486C0 |
0_2_005486C0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00547760 |
0_2_00547760 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004E77E0 |
0_2_004E77E0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004547BF |
0_2_004547BF |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0043C960 |
0_2_0043C960 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0043A928 |
0_2_0043A928 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0044DA86 |
0_2_0044DA86 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00458BB0 |
0_2_00458BB0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004EEC40 |
0_2_004EEC40 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004EFC40 |
0_2_004EFC40 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00534D40 |
0_2_00534D40 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00546D20 |
0_2_00546D20 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00545DE0 |
0_2_00545DE0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00458E30 |
0_2_00458E30 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00541F00 |
0_2_00541F00 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004F2FD0 |
0_2_004F2FD0 |
Source: file.exe, 00000000.00000002.3555956165.000000000055D000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1675059249.0000000002990000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2474939313.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.4142206687.000000000055E000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.4142253887.000000000055E000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.2475489562.0000000002760000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2567545061.0000000000CE0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.4142172979.000000000055D000.00000002.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000C.00000003.2648323919.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000C.00000002.4142168146.000000000055D000.00000002.00000001.01000000.00000006.sdmp |
Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q); |
Source: file.exe, 00000000.00000002.3555956165.000000000055D000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1675059249.0000000002990000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2474939313.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.4142206687.000000000055E000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.4142253887.000000000055E000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.2475489562.0000000002760000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2567545061.0000000000CE0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.4142172979.000000000055D000.00000002.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000000C.00000003.2648323919.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000C.00000002.4142168146.000000000055D000.00000002.00000001.01000000.00000006.sdmp |
Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger'); |
Source: file.exe, 00000000.00000003.3159035158.0000000005798000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3159314134.0000000005798000.00000004.00000020.00020000.00000000.sdmp, L8VsEhFCGIPBLogin Data.0.dr, 8uidv_1gOa1CLogin Data For Account.0.dr |
Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key)); |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: vaultcli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: xmllite.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: xmllite.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\ProgramData\MPGPH131\MPGPH131.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d11.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxgi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: d3d10warp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dxcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
0_2_004C6000 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error, |
0_2_004E6770 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree, |
0_2_00493F40 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, |
0_2_004DFF00 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError, |
0_2_00431F9C |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
0_2_00432022 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004E67A8 FindFirstFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError, |
0_2_004E67A8 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
0_2_004938D0 |
Source: MPGPH131.exe, 00000009.00000002.4144559384.0000000000C47000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__ |
Source: Amcache.hve.15.dr |
Binary or memory string: VMware |
Source: Amcache.hve.15.dr |
Binary or memory string: VMware Virtual USB Mouse |
Source: file.exe, 00000000.00000002.3557114655.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b |
Source: Amcache.hve.15.dr |
Binary or memory string: vmci.syshbin |
Source: file.exe, 00000000.00000003.2453319184.0000000000C82000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}! |
Source: file.exe, 00000000.00000002.3558548817.00000000057DE000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_4FD3E300 |
Source: Amcache.hve.15.dr |
Binary or memory string: VMware, Inc. |
Source: RageMP131.exe, 0000000C.00000002.4144857009.0000000000E93000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: Amcache.hve.15.dr |
Binary or memory string: VMware20,1hbin@ |
Source: Amcache.hve.15.dr |
Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563 |
Source: Amcache.hve.15.dr |
Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: Amcache.hve.15.dr |
Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys |
Source: file.exe, 00000000.00000002.3557114655.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.4144884433.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.4144884433.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.4144884433.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000C.00000002.4144857009.0000000000E80000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000C.00000002.4144857009.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW |
Source: Amcache.hve.15.dr |
Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: RageMP131.exe, 0000000C.00000002.4144857009.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWen-GBn |
Source: file.exe, 00000000.00000002.3557114655.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWh |
Source: file.exe, 00000000.00000002.3557114655.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}5 |
Source: RageMP131.exe, 0000000C.00000003.3793475150.0000000000E99000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: RageMP131.exe, 0000000C.00000002.4144857009.0000000000E93000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_di |
Source: Amcache.hve.15.dr |
Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev |
Source: Amcache.hve.15.dr |
Binary or memory string: c:/windows/system32/drivers/vmci.sys |
Source: file.exe, 00000000.00000002.3557114655.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}sz |
Source: Amcache.hve.15.dr |
Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: RageMP131.exe, 0000000C.00000002.4144857009.0000000000E30000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000& |
Source: Amcache.hve.15.dr |
Binary or memory string: vmci.sys |
Source: Amcache.hve.15.dr |
Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0 |
Source: file.exe, 00000000.00000002.3558548817.00000000057DE000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}es=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows |
Source: Amcache.hve.15.dr |
Binary or memory string: vmci.syshbin` |
Source: MPGPH131.exe, 00000008.00000002.4145036164.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__m |
Source: Amcache.hve.15.dr |
Binary or memory string: \driver\vmci,\driver\pci |
Source: Amcache.hve.15.dr |
Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: MPGPH131.exe, 00000008.00000002.4141460726.000000000009C000.00000004.00000010.00020000.00000000.sdmp |
Binary or memory string: \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__em00024 |
Source: MPGPH131.exe, 00000008.00000002.4144739037.0000000000CE5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.4144784186.0000000000DE5000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ |
Source: Amcache.hve.15.dr |
Binary or memory string: VMware20,1 |
Source: Amcache.hve.15.dr |
Binary or memory string: Microsoft Hyper-V Generation Counter |
Source: Amcache.hve.15.dr |
Binary or memory string: NECVMWar VMware SATA CD00 |
Source: Amcache.hve.15.dr |
Binary or memory string: VMware Virtual disk SCSI Disk Device |
Source: Amcache.hve.15.dr |
Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom |
Source: Amcache.hve.15.dr |
Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk |
Source: Amcache.hve.15.dr |
Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver |
Source: Amcache.hve.15.dr |
Binary or memory string: VMware PCI VMCI Bus Device |
Source: Amcache.hve.15.dr |
Binary or memory string: VMware VMCI Bus Device |
Source: Amcache.hve.15.dr |
Binary or memory string: VMware Virtual RAM |
Source: Amcache.hve.15.dr |
Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1 |
Source: MPGPH131.exe, 00000009.00000002.4141585370.000000000009C000.00000004.00000010.00020000.00000000.sdmp |
Binary or memory string: \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__em00024 |
Source: Amcache.hve.15.dr |
Binary or memory string: vmci.inf_amd64_68ed49469341f563 |
Source: C:\Users\user\Desktop\file.exe |
Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, |
0_2_004DFF00 |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetLocaleInfoW, |
0_2_004531CA |
Source: C:\Users\user\Desktop\file.exe |
Code function: EnumSystemLocalesW, |
0_2_0044B1B1 |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, |
0_2_004532F3 |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetLocaleInfoW, |
0_2_004533F9 |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, |
0_2_004534CF |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetLocaleInfoW, |
0_2_0044B734 |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetACP,IsValidCodePage,GetLocaleInfoW, |
0_2_00452B5A |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetLocaleInfoW, |
0_2_00452D5F |
Source: C:\Users\user\Desktop\file.exe |
Code function: EnumSystemLocalesW, |
0_2_00452E51 |
Source: C:\Users\user\Desktop\file.exe |
Code function: EnumSystemLocalesW, |
0_2_00452E06 |
Source: C:\Users\user\Desktop\file.exe |
Code function: EnumSystemLocalesW, |
0_2_00452EEC |
Source: C:\Users\user\Desktop\file.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, |
0_2_00452F77 |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT |
Jump to behavior |