Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1435033
MD5: 89614bcd95a77224939391e14e6a45d4
SHA1: 369605f8fbcafdd3cad56c3cd22c3c0f468d11b5
SHA256: 8f2d99ca04db3fc50810158be6f60f4df8df819dd30227d58287f71b220fbfb8
Tags: exe
Infos:

Detection

RisePro Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected RisePro Stealer
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject threads in other processes
Found many strings related to Crypto-Wallets (likely being stolen)
Found stalling execution ending in API Sleep call
Hides threads from debuggers
PE file has nameless sections
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Found decision node followed by non-executed suspicious APIs
Found evaded block containing many API calls
Found evasive API chain (date check)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for URL or domain
Source: http://147.45.47.102:57893/hera/amadka.exe Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Avira: detection malicious, Label: HEUR/AGEN.1306558
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Avira: detection malicious, Label: HEUR/AGEN.1306558
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\MPGPH131\MPGPH131.exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe ReversingLabs: Detection: 34%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 34%
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A53EB0 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree, 0_2_00A53EB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F13EB0 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree, 9_2_00F13EB0
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49737 version: TLS 1.0
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.41.168.93:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.41.168.93:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.24.148:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.24.148:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.24.148:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A6D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, 0_2_00A6D2B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A533B0 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose, 0_2_00A533B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A21A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree, 0_2_00A21A60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A73B20 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error, 0_2_00A73B20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C1F8C FindClose,FindFirstFileExW,GetLastError, 0_2_009C1F8C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C2012 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, 0_2_009C2012
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A213F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, 0_2_00A213F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_012B7D7B FindFirstFileA, 0_2_012B7D7B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F2D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, 9_2_00F2D2B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F133B0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, 9_2_00F133B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EE1A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA, 9_2_00EE1A60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F33B20 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error, 9_2_00F33B20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E81F8C FindClose,FindFirstFileExW,GetLastError, 9_2_00E81F8C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E82012 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, 9_2_00E82012
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EE13F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, 9_2_00EE13F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_01777D7B FindFirstFileA, 9_2_01777D7B
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_4ff78eb511e9ac22ab5b6b8041e2eba262b7b25a_2d68038f_84e3953a-ab19-442c-8262-786cc4f1cd99\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_861171296e904e2fbf4fe342343ec91fba117fc8_4dfd30ff_7f5da373-70e7-4ba0-984f-dfac6096d171\

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.5:49705 -> 147.45.47.93:58709
Source: Traffic Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49705
Source: Traffic Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49705 -> 147.45.47.93:58709
Source: Traffic Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49720
Source: Traffic Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49721
Source: Traffic Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.5:49720
Source: Traffic Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49728
Source: Traffic Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49721 -> 147.45.47.93:58709
Source: Traffic Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49728 -> 147.45.47.93:58709
Source: Traffic Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49720 -> 147.45.47.93:58709
Source: Traffic Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.5:49741
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 147.45.47.93:58709
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 172.67.75.166 172.67.75.166
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 147.45.47.93 147.45.47.93
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49737 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A552A0 recv,GetCurrentProcess, 0_2_00A552A0
Source: global traffic HTTP traffic detected: GET /widget/demo/191.96.150.225 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=191.96.150.225 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YJbhGM-Py7EGIjD8QrEj1gFdvHchlLTa-4si6HNrr72UxT2vpiqG82uHrppu3FZXoKV_deHD3oWlfcwyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-01-22; NID=513=WjG_BEc-4VX4Uei0XfTx3kb38Bbln3bzSkk0tpaqsyyb7pwMYs9hFUTXEKMeDo72wKj66mSdnT-_6SJuKl7PYzsfOh6EB58w0NcL-Jt0mviEvwtIiEN4ou5rPuUWsySpd1T8WrXS0HSl0BREVepkvhBZzxkK_euTguK_FKUnn74
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YJbhGM-Py7EGIjAcQKAitKqMUDtLRvKqfuyC23FhLvjISe5YubFOHGlwiTqxFBVIZH0lidwOcKuqd9YyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-01-22; NID=513=WjG_BEc-4VX4Uei0XfTx3kb38Bbln3bzSkk0tpaqsyyb7pwMYs9hFUTXEKMeDo72wKj66mSdnT-_6SJuKl7PYzsfOh6EB58w0NcL-Jt0mviEvwtIiEN4ou5rPuUWsySpd1T8WrXS0HSl0BREVepkvhBZzxkK_euTguK_FKUnn74
Source: global traffic HTTP traffic detected: GET /widget/demo/191.96.150.225 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/191.96.150.225 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=191.96.150.225 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=191.96.150.225 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /widget/demo/191.96.150.225 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=191.96.150.225 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=p5BKpMdvsVFL4z3&MD=MBhW+xD9 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /widget/demo/191.96.150.225 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=191.96.150.225 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=p5BKpMdvsVFL4z3&MD=MBhW+xD9 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic DNS traffic detected: DNS query: ipinfo.io
Source: global traffic DNS traffic detected: DNS query: db-ip.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2427745896.00000000008FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: MPGPH131.exe, 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe68.0
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeets
Source: MPGPH131.exe, 0000000A.00000002.2427745896.00000000008FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeetslZ
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.56/cost/go.exe
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.56/cost/go.exe50.225
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.56/cost/go.exeI
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.56/cost/go.exeadka.exeata
Source: MPGPH131.exe, 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.56/cost/go.exeb
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2427745896.00000000008FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.56/cost/lenin.exe
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.56/cost/lenin.exe3.Y
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.56/cost/lenin.exeiner
Source: MPGPH131.exe, 0000000A.00000002.2427745896.00000000008FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.56/cost/lenin.exenlataa
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.56/cost/lenin.exeser
Source: MPGPH131.exe, 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.56/cost/lenin.exey
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.microsoft
Source: file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr String found in binary or memory: http://pki-ocsp.symauth.com0
Source: Amcache.hve.17.dr String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000002.2427619726.0000000000991000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427385231.0000000000E51000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2428932291.0000000000E51000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2265801484.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345379815.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.winimage.com/zLibDll
Source: file.exe, 00000000.00000003.2125646433.000000000745A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2089953077.0000000007558000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091856529.0000000007568000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2223015252.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2226775098.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2226133578.0000000000965000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2214524801.0000000000920000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2219645019.000000000095D000.00000004.00000020.00020000.00000000.sdmp, JVSmqGXSj18IWeb Data.10.dr, 5k6XxOEVUvZtWeb Data.0.dr, ExhiT_zPNV5SWeb Data.10.dr, zXnAr1pXr2StWeb Data.10.dr, _FPOfGimSz5aWeb Data.0.dr, sQbc2vl85l1MWeb Data.0.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2125646433.000000000745A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2089953077.0000000007558000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091856529.0000000007568000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2223015252.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2226775098.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2226133578.0000000000965000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2214524801.0000000000920000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2219645019.000000000095D000.00000004.00000020.00020000.00000000.sdmp, JVSmqGXSj18IWeb Data.10.dr, 5k6XxOEVUvZtWeb Data.0.dr, ExhiT_zPNV5SWeb Data.10.dr, zXnAr1pXr2StWeb Data.10.dr, _FPOfGimSz5aWeb Data.0.dr, sQbc2vl85l1MWeb Data.0.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2125646433.000000000745A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2089953077.0000000007558000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091856529.0000000007568000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2223015252.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2226775098.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2226133578.0000000000965000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2214524801.0000000000920000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2219645019.000000000095D000.00000004.00000020.00020000.00000000.sdmp, JVSmqGXSj18IWeb Data.10.dr, 5k6XxOEVUvZtWeb Data.0.dr, ExhiT_zPNV5SWeb Data.10.dr, zXnAr1pXr2StWeb Data.10.dr, _FPOfGimSz5aWeb Data.0.dr, sQbc2vl85l1MWeb Data.0.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2125646433.000000000745A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2089953077.0000000007558000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091856529.0000000007568000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2223015252.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2226775098.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2226133578.0000000000965000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2214524801.0000000000920000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2219645019.000000000095D000.00000004.00000020.00020000.00000000.sdmp, JVSmqGXSj18IWeb Data.10.dr, 5k6XxOEVUvZtWeb Data.0.dr, ExhiT_zPNV5SWeb Data.10.dr, zXnAr1pXr2StWeb Data.10.dr, _FPOfGimSz5aWeb Data.0.dr, sQbc2vl85l1MWeb Data.0.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2265132393.0000000000B0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2346758187.0000000002127000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2265132393.0000000000B0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2346758187.0000000002127000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.150.225
Source: MPGPH131.exe, 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.150.225/A
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.150.225P=
Source: RageMP131.exe, 00000010.00000002.2346758187.0000000002127000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.150.225f
Source: MPGPH131.exe, 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.150.225im
Source: RageMP131.exe, 00000010.00000002.2346758187.0000000002127000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.150.225k
Source: RageMP131.exe, 00000010.00000002.2346758187.0000000002127000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.150.225q
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=191.96.150.225v
Source: MPGPH131.exe, 0000000A.00000002.2427745896.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2265132393.0000000000B0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2346758187.00000000020A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com:443/demo/home.php?s=191.96.150.225
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com:443/demo/home.php?s=191.96.150.2256
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com:443/demo/home.php?s=191.96.150.225P
Source: file.exe, 00000000.00000003.2125646433.000000000745A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2089953077.0000000007558000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091856529.0000000007568000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2223015252.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2226775098.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2226133578.0000000000965000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2214524801.0000000000920000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2219645019.000000000095D000.00000004.00000020.00020000.00000000.sdmp, JVSmqGXSj18IWeb Data.10.dr, 5k6XxOEVUvZtWeb Data.0.dr, ExhiT_zPNV5SWeb Data.10.dr, zXnAr1pXr2StWeb Data.10.dr, _FPOfGimSz5aWeb Data.0.dr, sQbc2vl85l1MWeb Data.0.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2125646433.000000000745A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2089953077.0000000007558000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091856529.0000000007568000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2223015252.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2226775098.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2226133578.0000000000965000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2214524801.0000000000920000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2219645019.000000000095D000.00000004.00000020.00020000.00000000.sdmp, JVSmqGXSj18IWeb Data.10.dr, 5k6XxOEVUvZtWeb Data.0.dr, ExhiT_zPNV5SWeb Data.10.dr, zXnAr1pXr2StWeb Data.10.dr, _FPOfGimSz5aWeb Data.0.dr, sQbc2vl85l1MWeb Data.0.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2125646433.000000000745A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2089953077.0000000007558000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091856529.0000000007568000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2223015252.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2226775098.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2226133578.0000000000965000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2214524801.0000000000920000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2219645019.000000000095D000.00000004.00000020.00020000.00000000.sdmp, JVSmqGXSj18IWeb Data.10.dr, 5k6XxOEVUvZtWeb Data.0.dr, ExhiT_zPNV5SWeb Data.10.dr, zXnAr1pXr2StWeb Data.10.dr, _FPOfGimSz5aWeb Data.0.dr, sQbc2vl85l1MWeb Data.0.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RageMP131.exe, 00000010.00000002.2346758187.0000000002127000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/
Source: RageMP131.exe, 00000010.00000002.2346758187.00000000020D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/#
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2429513951.00000000020C0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2427745896.0000000000849000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2265132393.0000000000AFF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2346758187.0000000002127000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: RageMP131.exe, 0000000B.00000002.2265132393.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/g
Source: file.exe, 00000000.00000002.2427619726.0000000000991000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427385231.0000000000E51000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2428932291.0000000000E51000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2265801484.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345379815.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: file.exe, 00000000.00000002.2429632265.0000000001647000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/s
Source: MPGPH131.exe, 0000000A.00000002.2427745896.0000000000800000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2265132393.0000000000AFF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2265132393.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2346758187.0000000002127000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2346758187.00000000020DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/widget/demo/191.96.150.225
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/widget/demo/191.96.150.225ao
Source: RageMP131.exe, 0000000B.00000002.2265132393.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/widget/demo/191.96.150.225w&rc
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020C0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2265132393.0000000000AFF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2346758187.00000000020A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io:443/widget/demo/191.96.150.225
Source: MPGPH131.exe, 0000000A.00000002.2427745896.00000000007C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io:443/widget/demo/191.96.150.225av
Source: file.exe, 00000000.00000002.2429632265.000000000167F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io:443/widget/demo/191.96.150.225h
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: RageMP131.exe, 0000000B.00000002.2265132393.0000000000B0D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.=
Source: file.exe, 00000000.00000002.2429632265.00000000016DA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2429513951.0000000002120000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2429513951.000000000203D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2429513951.0000000002177000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2427745896.000000000089F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2427745896.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2265132393.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2346758187.00000000020A7000.00000004.00000020.00020000.00000000.sdmp, D1SiR_BVePEjKzuadHx_JwJ.zip.0.dr, zDi5_AnRQpJszWGhtVDPo4q.zip.9.dr String found in binary or memory: https://t.me/RiseProSUPPORT
Source: MPGPH131.exe, 00000009.00000002.2429513951.0000000002177000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/RiseProSUPPORTAM
Source: file.exe, 00000000.00000002.2429632265.00000000016DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/RiseProSUPPORTI
Source: RageMP131.exe, 0000000B.00000002.2265132393.0000000000B0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2346758187.0000000002127000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro
Source: RageMP131.exe, 00000010.00000002.2346758187.0000000002127000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2346758187.000000000218B000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.10.dr, passwords.txt.0.dr String found in binary or memory: https://t.me/risepro_bot
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_bot&.N
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_botO
Source: RageMP131.exe, 00000010.00000002.2346758187.0000000002127000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_botlater
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_botrisepro
Source: file.exe, 00000000.00000003.2125646433.000000000745A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2089953077.0000000007558000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091856529.0000000007568000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2223015252.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2226775098.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2226133578.0000000000965000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2214524801.0000000000920000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2219645019.000000000095D000.00000004.00000020.00020000.00000000.sdmp, JVSmqGXSj18IWeb Data.10.dr, 5k6XxOEVUvZtWeb Data.0.dr, ExhiT_zPNV5SWeb Data.10.dr, zXnAr1pXr2StWeb Data.10.dr, _FPOfGimSz5aWeb Data.0.dr, sQbc2vl85l1MWeb Data.0.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2125646433.000000000745A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2089953077.0000000007558000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091856529.0000000007568000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2223015252.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2226775098.00000000021A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2226133578.0000000000965000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2214524801.0000000000920000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2219645019.000000000095D000.00000004.00000020.00020000.00000000.sdmp, JVSmqGXSj18IWeb Data.10.dr, 5k6XxOEVUvZtWeb Data.0.dr, ExhiT_zPNV5SWeb Data.10.dr, zXnAr1pXr2StWeb Data.10.dr, _FPOfGimSz5aWeb Data.0.dr, sQbc2vl85l1MWeb Data.0.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, MPGPH131.exe String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: MPGPH131.exe, 0000000A.00000002.2427745896.00000000008FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/7/
Source: file.exe, 00000000.00000003.2093077786.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2129311961.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2087711941.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2128076416.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090683049.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095025039.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095725751.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2128854941.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170435434.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2089379370.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132236435.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2093956480.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2092333248.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2128277275.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090022364.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2086000968.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2430670265.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2131008373.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2138304842.0000000001747000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2223453262.0000000000907000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2226692063.0000000000907000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MPGPH131.exe, 0000000A.00000002.2427745896.00000000008FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/zZ
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2093077786.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2129311961.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2087711941.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2128076416.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090683049.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095025039.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095725751.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2128854941.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170435434.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2089379370.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132236435.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2093956480.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2092333248.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2128277275.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090022364.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2086000968.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2430670265.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2131008373.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2138304842.0000000001747000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2220736811.0000000002181000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2248202903.0000000002181000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2221943707.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2255757744.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2223453262.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2226542785.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2254690083.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2220249361.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2229799767.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2218291567.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2231329562.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2228436366.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2218842315.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2248745168.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2222989721.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2224405345.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2427745896.00000000008FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/a
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/ata
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/efox/u.
Source: file.exe, 00000000.00000003.2093077786.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2129311961.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2087711941.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2128076416.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090683049.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095025039.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2095725751.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2128854941.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2170435434.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2089379370.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132236435.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2093956480.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2092333248.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2128277275.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090022364.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2086000968.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2430670265.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2131008373.0000000001747000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2138304842.0000000001747000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2220736811.0000000002181000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2248202903.0000000002181000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/irefox
Source: MPGPH131.exe, 0000000A.00000002.2427745896.00000000008FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/ktopaqZ
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.41.168.93:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.41.168.93:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.24.148:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.24.148:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.24.148:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49756 version: TLS 1.2

System Summary
barindex
PE file has nameless sections
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name:
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A88080 0_2_00A88080
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D001D 0_2_009D001D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A261D0 0_2_00A261D0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A6D2B0 0_2_00A6D2B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A6C3E0 0_2_00A6C3E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A6B7E0 0_2_00A6B7E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A0F730 0_2_00A0F730
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0099B8E0 0_2_0099B8E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00ACC8D0 0_2_00ACC8D0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A649B0 0_2_00A649B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A28A80 0_2_00A28A80
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A21A60 0_2_00A21A60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A2CBF0 0_2_00A2CBF0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A37D20 0_2_00A37D20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A2AEC0 0_2_00A2AEC0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A23ED0 0_2_00A23ED0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A1DF60 0_2_00A1DF60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AD40A0 0_2_00AD40A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AC20C0 0_2_00AC20C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C7190 0_2_009C7190
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A31130 0_2_00A31130
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A12100 0_2_00A12100
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AD3160 0_2_00AD3160
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009D035F 0_2_009D035F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A80350 0_2_00A80350
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009BF570 0_2_009BF570
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E47AD 0_2_009E47AD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009CA918 0_2_009CA918
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009CC950 0_2_009CC950
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00AD4AE0 0_2_00AD4AE0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009DDA74 0_2_009DDA74
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A20BA0 0_2_00A20BA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A74B90 0_2_00A74B90
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E8BA0 0_2_009E8BA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009E8E20 0_2_009E8E20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A31E40 0_2_00A31E40
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A7BFC0 0_2_00A7BFC0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A7CFC0 0_2_00A7CFC0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F560000 0_2_7F560000
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F5608C1 0_2_7F5608C1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F48080 9_2_00F48080
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E9001D 9_2_00E9001D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EE61D0 9_2_00EE61D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F2D2B0 9_2_00F2D2B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F2C3E0 9_2_00F2C3E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F2B7E0 9_2_00F2B7E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00ECF730 9_2_00ECF730
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E5B8E0 9_2_00E5B8E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F8C8D0 9_2_00F8C8D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F249B0 9_2_00F249B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EE8A80 9_2_00EE8A80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EE1A60 9_2_00EE1A60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EECBF0 9_2_00EECBF0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EF7D20 9_2_00EF7D20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EEAEC0 9_2_00EEAEC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EE3ED0 9_2_00EE3ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EDDF60 9_2_00EDDF60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F820C0 9_2_00F820C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F940A0 9_2_00F940A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E87190 9_2_00E87190
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F93160 9_2_00F93160
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EF1130 9_2_00EF1130
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00ED2100 9_2_00ED2100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F8F280 9_2_00F8F280
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F40350 9_2_00F40350
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E9035F 9_2_00E9035F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EA25FE 9_2_00EA25FE
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E7F570 9_2_00E7F570
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EA47AD 9_2_00EA47AD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E8C950 9_2_00E8C950
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E8A918 9_2_00E8A918
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F94AE0 9_2_00F94AE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E8AADF 9_2_00E8AADF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E9DA74 9_2_00E9DA74
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F95A40 9_2_00F95A40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EA8BA0 9_2_00EA8BA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EE0BA0 9_2_00EE0BA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F34B90 9_2_00F34B90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EF1E40 9_2_00EF1E40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EA8E20 9_2_00EA8E20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F3CFC0 9_2_00F3CFC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F3BFC0 9_2_00F3BFC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_7F000000 9_2_7F000000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_7F0008C1 9_2_7F0008C1
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\file.exe Code function: String function: 009AACE0 appears 86 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: String function: 00E6ACE0 appears 86 times
One or more processes crash
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 2040
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000002.2428013562.0000000000B34000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs file.exe
Source: file.exe Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: ZLIB complexity 0.999758565110827
Source: file.exe Static PE information: Section: ZLIB complexity 0.9933987403100775
Source: file.exe Static PE information: Section: ZLIB complexity 0.994140625
Source: file.exe Static PE information: Section: ZLIB complexity 1.0006510416666667
Source: RageMP131.exe.0.dr Static PE information: Section: ZLIB complexity 0.999758565110827
Source: RageMP131.exe.0.dr Static PE information: Section: ZLIB complexity 0.9933987403100775
Source: RageMP131.exe.0.dr Static PE information: Section: ZLIB complexity 0.994140625
Source: RageMP131.exe.0.dr Static PE information: Section: ZLIB complexity 1.0006510416666667
Source: MPGPH131.exe.0.dr Static PE information: Section: ZLIB complexity 0.999758565110827
Source: MPGPH131.exe.0.dr Static PE information: Section: ZLIB complexity 0.9933987403100775
Source: MPGPH131.exe.0.dr Static PE information: Section: ZLIB complexity 0.994140625
Source: MPGPH131.exe.0.dr Static PE information: Section: ZLIB complexity 1.0006510416666667
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@31/70@6/8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A6D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, 0_2_00A6D2B0
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\RageMP131 Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5044
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4424:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7608
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1264:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5996
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe, 00000000.00000002.2427619726.0000000000991000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427385231.0000000000E51000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2428932291.0000000000E51000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2265801484.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345379815.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2427619726.0000000000991000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427385231.0000000000E51000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2428932291.0000000000E51000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2265801484.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345379815.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000003.2087091992.000000000174F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2218943612.0000000002182000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2219792205.00000000021BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2218980553.00000000021AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2218536865.00000000021AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2218504847.0000000002182000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2229256457.00000000070C5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2214424911.0000000000931000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000003.2207899458.0000000000909000.00000004.00000020.00020000.00000000.sdmp, NWmsdsaUFVHXLogin Data For Account.10.dr, I88nKSjxTtJmLogin Data For Account.0.dr, EbTrCphTFGEiLogin Data.0.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe ReversingLabs: Detection: 34%
Source: file.exe String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1656 --field-trial-handle=2044,i,2102298994970093420,638329119076366736,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1592 --field-trial-handle=2044,i,2102298994970093420,638329119076366736,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 2040
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 1060
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7608 -s 1976
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1656 --field-trial-handle=2044,i,2102298994970093420,638329119076366736,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1592 --field-trial-handle=2044,i,2102298994970093420,638329119076366736,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: wldp.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: profapi.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: wininet.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: devobj.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: webio.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: schannel.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: version.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: rstrtmgr.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ncrypt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ntasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: shfolder.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: wldp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: profapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: sspicli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: d3d11.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: dxgi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: resourcepolicyclient.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: d3d10warp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: dxcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: winhttp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: wininet.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: mswsock.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: devobj.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: webio.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: iphlpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: winnsi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: dnsapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: rasadhlp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: fwpuclnt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: schannel.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: mskeyprotect.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ncryptsslp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: msasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: cryptsp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: rsaenh.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: gpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: vaultcli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: wintypes.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: ntmarta.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Section loaded: gpapi.dll
Source: Google Drive.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: file.exe Static file information: File size 3228672 > 1048576
Source: file.exe Static PE information: Raw size of .data is bigger than: 0x100000 < 0x22d400

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.990000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Unpacked PE file: 9.2.MPGPH131.exe.e50000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Unpacked PE file: 10.2.MPGPH131.exe.e50000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Unpacked PE file: 11.2.RageMP131.exe.dd0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Unpacked PE file: 16.2.RageMP131.exe.dd0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A5C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject, 0_2_00A5C630
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .data
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: RageMP131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name:
Source: MPGPH131.exe.0.dr Static PE information: section name:
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C3F49 push ecx; ret 0_2_009C3F5C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561750 push 7F560002h; ret 0_2_7F56175F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F560F40 push 7F560002h; ret 0_2_7F560F4F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F562740 push 7F560002h; ret 0_2_7F56274F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F560F70 push 7F560002h; ret 0_2_7F560F7F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F562770 push 7F560002h; ret 0_2_7F56277F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561F60 push 7F560002h; ret 0_2_7F561F6F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F560F10 push 7F560002h; ret 0_2_7F560F1F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F562710 push 7F560002h; ret 0_2_7F56271F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561F00 push 7F560002h; ret 0_2_7F561F0F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561F30 push 7F560002h; ret 0_2_7F561F3F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561720 push 7F560002h; ret 0_2_7F56172F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F560FD0 push 7F560002h; ret 0_2_7F560FDF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F5627D0 push 7F560002h; ret 0_2_7F5627DF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561FC0 push 7F560002h; ret 0_2_7F561FCF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561FF0 push 7F560002h; ret 0_2_7F561FFF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F5617E0 push 7F560002h; ret 0_2_7F5617EF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561F90 push 7F560002h; ret 0_2_7F561F9F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561780 push 7F560002h; ret 0_2_7F56178F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F5617B0 push 7F560002h; ret 0_2_7F5617BF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F560FA0 push 7F560002h; ret 0_2_7F560FAF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F5627A0 push 7F560002h; ret 0_2_7F5627AF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F560E50 push 7F560002h; ret 0_2_7F560E5F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F562650 push 7F560002h; ret 0_2_7F56265F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561E40 push 7F560002h; ret 0_2_7F561E4F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561E70 push 7F560002h; ret 0_2_7F561E7F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561660 push 7F560002h; ret 0_2_7F56166F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561E10 push 7F560002h; ret 0_2_7F561E1F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561600 push 7F560002h; ret 0_2_7F56160F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F561630 push 7F560002h; ret 0_2_7F56163F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_7F560E20 push 7F560002h; ret 0_2_7F560E2F
Source: file.exe Static PE information: section name: entropy: 7.999630025295813
Source: file.exe Static PE information: section name: entropy: 7.9911236263775685
Source: file.exe Static PE information: section name: entropy: 7.838614541323646
Source: file.exe Static PE information: section name: entropy: 7.992202653257848
Source: RageMP131.exe.0.dr Static PE information: section name: entropy: 7.999630025295813
Source: RageMP131.exe.0.dr Static PE information: section name: entropy: 7.9911236263775685
Source: RageMP131.exe.0.dr Static PE information: section name: entropy: 7.838614541323646
Source: RageMP131.exe.0.dr Static PE information: section name: entropy: 7.992202653257848
Source: MPGPH131.exe.0.dr Static PE information: section name: entropy: 7.999630025295813
Source: MPGPH131.exe.0.dr Static PE information: section name: entropy: 7.9911236263775685
Source: MPGPH131.exe.0.dr Static PE information: section name: entropy: 7.838614541323646
Source: MPGPH131.exe.0.dr Static PE information: section name: entropy: 7.992202653257848
Drops PE files
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\MPGPH131\MPGPH131.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\MPGPH131\MPGPH131.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131 Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Found stalling execution ending in API Sleep call
Source: C:\Users\user\Desktop\file.exe Stalling execution: Execution stalls by calling Sleep
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Stalling execution: Execution stalls by calling Sleep
Found decision node followed by non-executed suspicious APIs
Source: C:\Users\user\Desktop\file.exe Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Found evaded block containing many API calls
Source: C:\Users\user\Desktop\file.exe Evaded block: after key decision
Found evasive API chain (date check)
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\file.exe Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1864 Thread sleep count: 153 > 30 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7612 Thread sleep count: 137 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7904 Thread sleep count: 125 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7904 Thread sleep count: 39 > 30
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\file.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A6D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, 0_2_00A6D2B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A533B0 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose, 0_2_00A533B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A21A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree, 0_2_00A21A60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A73B20 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error, 0_2_00A73B20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C1F8C FindClose,FindFirstFileExW,GetLastError, 0_2_009C1F8C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C2012 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, 0_2_009C2012
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A213F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, 0_2_00A213F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_012B7D7B FindFirstFileA, 0_2_012B7D7B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F2D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, 9_2_00F2D2B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F133B0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, 9_2_00F133B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EE1A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA, 9_2_00EE1A60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F33B20 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error, 9_2_00F33B20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E81F8C FindClose,FindFirstFileExW,GetLastError, 9_2_00E81F8C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E82012 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, 9_2_00E82012
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EE13F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose, 9_2_00EE13F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_01777D7B FindFirstFileA, 9_2_01777D7B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A6D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, 0_2_00A6D2B0
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_4ff78eb511e9ac22ab5b6b8041e2eba262b7b25a_2d68038f_84e3953a-ab19-442c-8262-786cc4f1cd99\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_861171296e904e2fbf4fe342343ec91fba117fc8_4dfd30ff_7f5da373-70e7-4ba0-984f-dfac6096d171\
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: formVMware20,11696428655
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.2429632265.0000000001657000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000?
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ccount.microsoft.com/profileVMware20,11696428655u
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: file.exe, 00000000.00000003.2128707387.0000000007441000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware20,11696428655
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}*P
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: Amcache.hve.17.dr Binary or memory string: vmci.sys
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: AMC password management pageVMware20,11696428655
Source: RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: vmware
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000003.2128707387.0000000007441000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CT name, value FROM autofillmain'.sqlite_masterr global passwords blocklistVMware20,11696428655
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\*
Source: Amcache.hve.17.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: discord.comVMware20,11696428655f
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,116
Source: Amcache.hve.17.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000003.2133101057.000000000744B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696428
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: Amcache.hve.17.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000000.00000003.2027406050.000000000166D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}<
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RageMP131.exe, 00000010.00000002.2346758187.00000000020FD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b})
Source: file.exe, 00000000.00000002.2432929932.0000000007540000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}cGVhZm1tZ2RwZmtvZ2tnaGNwaWhh2j4FMS4yLjDgPtDD9agG6D4A6D4G6D4L8D7Qw/WoBsoBWggBEAUYAiAAKAAwADgAQABIAFAAWABgAGgAeACAAQDIPgPSPiBtaGpmYm1kZ2NmamJicGFlb2pvZm9ob2VmZ2llaGphado+ATHgPtDD9agG6D4A8D7Qw/WoBsoBXggBEAUYAiAAKAAwADgAQABIAFAAWABgAGgCeACAAQDIPgPSPiBuY2JqZWxwamNoa3BiaWticGtjY2hraGtibG9kb2FtYdo+BTIuMC4y4D7Qw/WoBug+APA+0MP1qAbKAV8IARAFGAIgACgAMAA4AEAASABQAFgAYABoAngAgAEAyD4D0j4gbmtlaW1ob2dqZHBucGNjb29mcGxpaW1hYWhtYWFvbWXaPgYxLjMuMjHgPtDD9agG6D4A8D7Qw/WoBvgBsiiAAv///////////wGIAgGoAoQXsgIQd6OHVV3LMHKvjeie9v2i18o+1wcKBAgAEAASEgoCCAMSAggIGgIIASIECAAQARoPCg1ub19lbnYtbm9fdmVyIgIIAjJiCAAaLDQ3REVRcGo4SEJTYSsvVEltVys1SkNldVFlUmttNU5NcEpXWkczaFN1RlU9Ii4icFpMaFRhSjIzaE41dVF4d3p1MEsyQ1llcy9kdkp1RTkzVmJJVlYvTG5SQT0iKgA6Cwjz///v9/////8BQikSCjEuMy4xNzcuMTEYBSAAKg5SZWdLZXlOb3RGb3VuZDIHd2luZG93c1ICCAFa/AUJdZMYBFaWU0AR3SQGgZVTRkAZAAAAAAAAWUAZAAAAAAAANEAZAAAAAAAAWUAZAAAAAAAA8D8ZAAAAAAAA8D8ZAAAAAAAAAAAZAAAAAAAAAAAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAANEAZAAAAAAAAWUAZAAAAAAAAAAAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAA8D8ZAAAAAAAA8D8yFQiH9N6X29eyvKYBEggIABABIJCABDISCNvpsoebrM36GRIGCAAQASAQMhII++qnh8mYwYhfEgYIABABIBAyEgjozNnlpJyeyzkSBggAEAEgEDITCOC54qSdyuvjjgESBggAEAEgEDISCNn9xMr9td2KbRIGCAAQASAQMhIIgteJ4NSXj9E2EgYIABABIBAyEgjmzv2twIj8gn4SBggAEAEgEDIUCKfHy9mkub6BwwESBwgBEAEgkGAyFQiauYjc7KfS3OEBEggIABABIJCABDITCJnwsYm4+NWOLBIHCAEQASCQYDIUCNHJvLvV2cza5wESBwgBEAEgkGAyEwiQrNz7jbLTpQwSBwgBEAEgkGAyEgjVuuKf55342XkSBggAEAEgEDITCPeTqZiGj5aaSRIHCAEQASCQYDISCLPMhM/6sZX2NRIGCAAQASAQMhIIh6SA76Kw0u9WEgYIABABIBAyEwjcx7n5qNnem6MBEgYIABABIBAyFAjKvKW5jY/Wx+cBEgcIARABIJBgMhQIwqf5grzUgKTqARIHCAEQASCQYDIWCJiYntn49dXkggESCQgAEAEggICACDITCMuAzLDq3NSUzwESBggAEAEgEDITCIS9vZeNgI79kgESBggAEAEgEDITCP7Mx9PU/OC9iQESBggAEAEgEDISCNKq8/iqnu6OFRIGCAAQASAQMhQImuHa5M/ohPHnARIHCAEQASCQYHoCCACCAQIYAA==
Source: Amcache.hve.17.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: Amcache.hve.17.dr Binary or memory string: vmci.syshbin`
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: dev.azure.comVMware20,11696428655j
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000C67000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000001127000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000001127000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.00000000010A7000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.00000000010A7000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: ]DLL_Loader_VirtualMachine
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Hyper-V
Source: Amcache.hve.17.dr Binary or memory string: VMware
Source: MPGPH131.exe, 00000009.00000002.2429513951.0000000002120000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}OQ
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.2427745896.000000000081D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2265132393.0000000000ADA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2265132393.0000000000B0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.2346758187.0000000002127000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: RageMP131.exe, 00000010.00000003.2276918902.0000000002113000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.2128707387.0000000007441000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: eVMware20,11696428655
Source: Amcache.hve.17.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: file.exe, 00000000.00000003.2133101057.000000000744B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,1169642865
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: MPGPH131.exe, 0000000A.00000002.2427745896.000000000089F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_31EFD9D9
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: Amcache.hve.17.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.17.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ra Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: Amcache.hve.17.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: Amcache.hve.17.dr Binary or memory string: vmci.syshbin
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: Amcache.hve.17.dr Binary or memory string: VMware, Inc.
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: Amcache.hve.17.dr Binary or memory string: VMware20,1hbin@
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: xVBoxService.exe
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: Amcache.hve.17.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, 00000000.00000003.2128707387.0000000007441000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,1169642865
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,1169642865(
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: VMWare
Source: Amcache.hve.17.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: file.exe, 00000000.00000002.2432929932.0000000007540000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: #Windows 11 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: RageMP131.exe, 00000010.00000002.2346758187.00000000020FD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWp
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWf
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CT service, encrypted_token FROM token_servicerr global passwords blocklistVMware20,11696428655
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: r global passwords blocklistVMware20,11696428655
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: tasks.office.comVMware20,11696428655o
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: MPGPH131.exe, 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\Profiles\v6zchhhv.default-release\cookies.sqlite.L
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: Amcache.hve.17.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.17.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: file.exe, 00000000.00000003.2133101057.000000000744B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,116968hE
Source: Amcache.hve.17.dr Binary or memory string: VMware Virtual RAM
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: Amcache.hve.17.dr Binary or memory string: VMware Virtual USB Mouse
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: RageMP131.exe, 00000010.00000003.2276918902.0000000002115000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}vM
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: MPGPH131.exe, 00000009.00000002.2429513951.0000000002181000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}WABgAGgAeACAAQDIPgPSPiBtaGpmYm1kZ2NmamJicGFlb2pvZm9ob2VmZ2llaGphado+ATHgPtDD9agG6D4A8D7Qw/WoBsoBXggBEAUYAiAAKAAwADgAQABIAFAAWABgAGgCeACAAQDIPgPSPiBuY2JqZWxwamNoa3BiaWticGtjY2hraGtibG9kb2FtYdo+BTIuMC4y4D7Qw/WoBug+APA+0MP1qAbKAV8IARAFGAIgACgAMAA4AEAASABQAFgAYABoAngAgAEAyD4D0j4gbmtlaW1ob2dqZHBucGNjb29mcGxpaW1hYWhtYWFvbWXaPgYxLjMuMjHgPtDD9agG6D4A8D7Qw/WoBvgBsiiAAv///////////wGIAgGoAoQXsgIQd6OHVV3LMHKvjeie9v2i18o+1wcKBAgAEAASEgoCCAMSAggIGgIIASIECAAQARoPCg1ub19lbnYtbm9fdmVyIgIIAjJiCAAaLDQ3REVRcGo4SEJTYSsvVEltVys1SkNldVFlUmttNU5NcEpXWkczaFN1RlU9Ii4icFpMaFRhSjIzaE41dVF4d3p1MEsyQ1llcy9kdkp1RTkzVmJJVlYvTG5SQT0iKgA6Cwjz///v9/////8BQikSCjEuMy4xNzcuMTEYBSAAKg5SZWdLZXlOb3RGb3VuZDIHd2luZG93c1ICCAFa/AUJdZMYBFaWU0AR3SQGgZVTRkAZAAAAAAAAWUAZAAAAAAAANEAZAAAAAAAAWUAZAAAAAAAA8D8ZAAAAAAAA8D8ZAAAAAAAAAAAZAAAAAAAAAAAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAANEAZAAAAAAAAWUAZAAAAAAAAAAAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAAWUAZAAAAAAAA8D8ZAAAAAAAA8D8yFQiH9N6X29eyvKYBEggIABABIJCABDISCNvpsoebrM36GRIGCAAQASAQMhII++qnh8mYwYhfEgYIABABIBAyEgjozNnlpJyeyzkSBggAEAEgEDITCOC54qSdyuvjjgESBggAEAEgEDISCNn9xMr9td2KbRIGCAAQASAQMhIIgteJ4NSXj9E2EgYIABABIBAyEgjmzv2twIj8gn4SBggAEAEgEDIUCKfHy9mkub6BwwESBwgBEAEgkGAyFQiauYjc7KfS3OEBEggIABABIJCABDITCJnwsYm4+NWOLBIHCAEQASCQYDIUCNHJvLvV2cza5wESBwgBEAEgkGAyEwiQrNz7jbLTpQwSBwgBEAEgkGAyEgjVuuKf55342XkSBggAEAEgEDITCPeTqZiGj5aaSRIHCAEQASCQYDISCLPMhM/6sZX2NRIGCAAQASAQMhIIh6SA76Kw0u9WEgYIABABIBAyEwjcx7n5qNnem6MBEgYIABABIBAyFAjKvKW5jY/Wx+cBEgcIARABIJBgMhQIwqf5grzUgKTqARIHCAEQASCQYDIWCJiYntn49dXkggESCQgAEAEggICACDITCMuAzLDq3NSUzwESBggAEAEgEDITCIS9vZeNgI79kgESBggAEAEgEDITCP7Mx9PU/OC9iQESBggAEAEgEDISCNKq8/iqnu6OFRIGCAAQASAQMhQImuHa5M/ohPHnARIHCAEQASCQYHoCCACCAQIYAA==portnako
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Hyper-V (guest)
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: outlook.office.comVMware20,11696428655s
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: rootpagecomVMware20,11696428655o
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\Profiles\v6zchhhv.default-release\signons.sqlite$
Source: Amcache.hve.17.dr Binary or memory string: \driver\vmci,\driver\pci
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: pageformVMware20,11696428655
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000C67000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000001127000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000001127000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.00000000010A7000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.00000000010A7000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: ~VirtualMachineTypes
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2429632265.0000000001657000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW8=i
Source: file.exe, 00000000.00000002.2428172900.0000000000C67000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000001127000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000001127000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.00000000010A7000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.00000000010A7000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RageMP131.exe, 0000000B.00000002.2265132393.0000000000ADA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.17.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000003.2128707387.0000000007441000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696428(
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,116964280
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: Amcache.hve.17.dr Binary or memory string: VMware20,1
Source: Amcache.hve.17.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.17.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000003.2133101057.000000000744B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,116`eE
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: Amcache.hve.17.dr Binary or memory string: VMware VMCI Bus Device
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: o.inVMware20,11696428655~
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: MPGPH131.exe, 00000009.00000002.2429513951.0000000002099000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000@+
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: MPGPH131.exe, 0000000A.00000002.2432196128.00000000070C0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}uY+XSEVDnA1IoKyebetLKXNkMrFZ0jd1Pt++ap8HtUsBflen28i14xqJqyQv6sRFYdCbhsqn++1PQf8YXdPF8XF1jXx809o2+ZwYizc7kfQFySk+kbZK1SeS10ulvIVyIttjXi3T+zJJPtJ+0AJo6G0g9pTZq8JSHZZeYacf9h8XLB20l8fMFYWITger5mE2f5/Mx4syIvRjsens9odw3+rg/InfIZ/wmzwkaTEj6DKm++dzfv+c0vFC3D8f2s7k72Z0Ukz8EwouIe1bkY501BJ7hfChkygnMWGcfMN1qvYkL1PmepsrLCe+7PrjTT9DWxxPmCiSWb+gOtBMpse4ehc4bZmKHePuHQhDLOXZJkYk/Hnvpqinx5H/RAmF9V66QQ69c3cMlkknjABISDjEDarNtBv3HXar31WXkaip9ZJVp5sLd9nlL9WhDYe6ISuvZ7TbuTtMI6F2NpSZygFN4hSinlw/KNrXG+zuxoeQh8GV/bQoyysjszjrZo+INBnaym5T3wOwsZRu03A5qRtlohBqieG9UBS/xJIQCb65ZPjLSYA1UsqV03RwU1/UB6p/RD1DZQedWvTfeuDLdYDtuOxvs8eTBRItSXliIe0N33NsM3juO9+6aX4TRP6gG3TEPU8Xu6Sd9e6CqCy4nhjcJeWXR2oPRPamAuq4EscYzo7LuUE8pUD3rbQUv114Ne899WnABbDSGvrPiywJvCAusqv5tRAhzjgQwwBpI8z/okTePaceD+47SSJMKHBVnDa8t3EobjCR5LkbzWDGGDVA6b0Ufr8lcW+528sgxPGvbKbR2PcpIC3d3su9fylYuquyzj3LXd/N3Wpn46MsKQ7aeSd8e/yB5VTGfB33dfCS8KOTrC7S8OIqyLz4naUuoA1d2OVN2yXzETzQ/Dzt9y5UoYhqtHgPT8SsdoARtQNtTzf3CSvCPMX/WrTfgpugWrH9VM9RJk4EAg4W+xiEbSKfn96wx2hv5+Nf2Cy5RsUwuPvVT9ASEn0mpNp+mVefspQXJ7CCFPn+pXfl1PTIjxEKsxh/AQ6S00mdZr5WyqaqBCSKZ1q99BXZUBtcEZ6Ozvur/a728zeEHeAbFvJzpM8LVs7QmIiebjGgkEEEv4LuxeGx5qqN3375LRO9cVVCxsjKyLxYiz77yfyry9JtBaK7ZQg5GdJzr21bIiis/qRD7lJSzSzmtX4vRLfUoJgtTsrFUmjuQvX12s/BBSZYtfAKP/6AW7zogy7d0FLc56eoezL45mjOFsADbPi+VB8PF8g/sPALj5WH9tkcdqMzjPLO/DYY2Eopd/4OWR4KfskzdHeVWN7bIdDwADTKm9SnlwOlGOZXd5dapUC7i/LybdNTi46u9AV067bvbVsQLRmC33dwnNqXBUelwkuARCg4L13Cgq3xUlKvVKjop3y/+RRE1uWownKPeOq/zjcnbzB0uLhkEaWZ/zWOaWpjL3tcrXj/1aYc3/LsU79ir6mnUZajW97bNFqlIlme0E1bHb6xvUby/soAVVw6bR9W4AgDF7dL4uyfhcsPDPhJMK/W5shEHgnplfoZHwl/HvPskQciS98AovdtaB1SHhdwJUCSD9T/0n/B8FM+El5+kjChYg+l/ml3fCvitoByu2joIKMrpGQQRx9tSU9IXjmjC+u0q/jOei/DdOWVd5katq5MjpT4/OcCmx8HRu6yhUQECikjQcYjr7j/0TfCsoBp3/5axIJ/UywVxRBK8QOJh3gyWdDHI093PAEO
Source: Amcache.hve.17.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: HARtive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: zQWs_Oe9McXZWeb Data.0.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: file.exe, 00000000.00000003.2170546459.000000000172F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}s
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: comVMware20,11696428655o
Source: MPGPH131.exe, 00000009.00000002.2429513951.0000000002099000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.17.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: MPGPH131.exe, 00000009.00000002.2429513951.0000000002099000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000VI
Source: MPGPH131.exe, 00000009.00000003.2118648526.00000000020AC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}}n
Source: RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: VBoxService.exe
Source: Amcache.hve.17.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MPGPH131.exe, 00000009.00000003.2255465199.0000000007ED0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.2428172900.0000000000B37000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000009.00000002.2427868974.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.2429355101.0000000000FF7000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 0000000B.00000002.2266169532.0000000000F77000.00000040.00000001.01000000.00000009.sdmp, RageMP131.exe, 00000010.00000002.2345668941.0000000000F77000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: RageMP131.exe, 00000010.00000002.2346758187.00000000020A7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Thread information set: HideFromDebugger
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Thread information set: HideFromDebugger
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Process queried: DebugPort Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Process queried: DebugPort Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Process queried: DebugPort
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C8A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_009C8A54
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A5C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject, 0_2_00A5C630
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A54130 mov eax, dword ptr fs:[00000030h] 0_2_00A54130
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A21A60 mov eax, dword ptr fs:[00000030h] 0_2_00A21A60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F14130 mov eax, dword ptr fs:[00000030h] 9_2_00F14130
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00EE1A60 mov eax, dword ptr fs:[00000030h] 9_2_00EE1A60
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A76E20 GetLastError,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,HeapFree,RtlAllocateHeap,HeapFree, 0_2_00A76E20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C450D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_009C450D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_009C8A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_009C8A54
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E8450D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 9_2_00E8450D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00E88A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_00E88A54

HIPS / PFW / Operating System Protection Evasion
barindex
Contains functionality to inject threads in other processes
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A5C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject, 0_2_00A5C630
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: 9_2_00F1C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject, 9_2_00F1C630
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\file.exe Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, 0_2_00A6D2B0
Source: C:\Users\user\Desktop\file.exe Code function: GetLocaleInfoW, 0_2_009E31B8
Source: C:\Users\user\Desktop\file.exe Code function: EnumSystemLocalesW, 0_2_009DB1A3
Source: C:\Users\user\Desktop\file.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 0_2_009E32E1
Source: C:\Users\user\Desktop\file.exe Code function: GetLocaleInfoW, 0_2_009E33E7
Source: C:\Users\user\Desktop\file.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 0_2_009E34BD
Source: C:\Users\user\Desktop\file.exe Code function: GetLocaleInfoW, 0_2_009DB726
Source: C:\Users\user\Desktop\file.exe Code function: GetACP,IsValidCodePage,GetLocaleInfoW, 0_2_009E2B48
Source: C:\Users\user\Desktop\file.exe Code function: GetLocaleInfoA, 0_2_012B7D69
Source: C:\Users\user\Desktop\file.exe Code function: EnumSystemLocalesW, 0_2_009E2DF4
Source: C:\Users\user\Desktop\file.exe Code function: GetLocaleInfoW, 0_2_009E2D4D
Source: C:\Users\user\Desktop\file.exe Code function: EnumSystemLocalesW, 0_2_009E2EDA
Source: C:\Users\user\Desktop\file.exe Code function: EnumSystemLocalesW, 0_2_009E2E3F
Source: C:\Users\user\Desktop\file.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 0_2_009E2F65
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, 9_2_00F2D2B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: EnumSystemLocalesW, 9_2_00E9B1A3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: GetLocaleInfoW, 9_2_00EA31B8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 9_2_00EA32E1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: GetLocaleInfoW, 9_2_00EA33E7
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 9_2_00EA34BD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: GetLocaleInfoW, 9_2_00E9B726
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: GetACP,IsValidCodePage,GetLocaleInfoW, 9_2_00EA2B48
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: GetLocaleInfoA, 9_2_01777D69
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: EnumSystemLocalesW, 9_2_00EA2DF4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: GetLocaleInfoW, 9_2_00EA2D4D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: EnumSystemLocalesW, 9_2_00EA2EDA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: EnumSystemLocalesW, 9_2_00EA2E3F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 9_2_00EA2F65
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\file.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A6D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, 0_2_00A6D2B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A6D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, 0_2_00A6D2B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00A6D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, 0_2_00A6D2B0
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.17.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.17.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.17.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.17.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected RisePro Stealer
Source: Yara match File source: 00000009.00000002.2429513951.0000000002120000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2427745896.000000000089F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2429632265.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2429632265.00000000016DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2427745896.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2429513951.0000000002177000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2429513951.000000000203D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 5996, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MPGPH131.exe PID: 5044, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MPGPH131.exe PID: 7608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RageMP131.exe PID: 7900, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RageMP131.exe PID: 1876, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\zDi5_AnRQpJszWGhtVDPo4q.zip, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\D1SiR_BVePEjKzuadHx_JwJ.zip, type: DROPPED
Found many strings related to Crypto-Wallets (likely being stolen)
Source: file.exe, 00000000.00000002.2430589246.000000000172F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\walletsUse
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: file.exe, 00000000.00000002.2430589246.000000000172F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Jaxx\Local Storageas
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet*
Source: file.exe, 00000000.00000002.2430589246.000000000172F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\walletss\
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet*
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: file.exe, 00000000.00000002.2430589246.000000000172F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\walletss\
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets*
Source: file.exe, 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: MPGPH131.exe, 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\formhistory.sqlite Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\places.sqlite Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\signons.sqlite Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Yara detected Credential Stealer
Source: Yara match File source: 0000000A.00000002.2427745896.000000000089F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2427745896.0000000000855000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2429632265.0000000001687000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2429513951.00000000020D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 5996, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MPGPH131.exe PID: 5044, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MPGPH131.exe PID: 7608, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected RisePro Stealer
Source: Yara match File source: 00000009.00000002.2429513951.0000000002120000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2427745896.000000000089F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2429632265.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2429632265.00000000016DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2427745896.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2429513951.0000000002177000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2429513951.000000000203D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 5996, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MPGPH131.exe PID: 5044, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MPGPH131.exe PID: 7608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RageMP131.exe PID: 7900, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RageMP131.exe PID: 1876, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\zDi5_AnRQpJszWGhtVDPo4q.zip, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\D1SiR_BVePEjKzuadHx_JwJ.zip, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1435033 Sample: file.exe Startdate: 02/05/2024 Architecture: WINDOWS Score: 100 46 ipinfo.io 2->46 48 db-ip.com 2->48 66 Snort IDS alert for network traffic 2->66 68 Antivirus detection for URL or domain 2->68 70 Antivirus / Scanner detection for submitted sample 2->70 72 4 other signatures 2->72 8 file.exe 6 63 2->8         started        13 MPGPH131.exe 5 48 2->13         started        15 RageMP131.exe 2->15         started        17 3 other processes 2->17 signatures3 process4 dnsIp5 50 147.45.47.93, 49705, 49720, 49721 FREE-NET-ASFREEnetEU Russian Federation 8->50 52 ipinfo.io 34.117.186.192, 443, 49706, 49723 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 8->52 54 db-ip.com 172.67.75.166, 443, 49707, 49726 CLOUDFLARENETUS United States 8->54 38 C:\Users\user\AppData\Local\...\RageMP131.exe, PE32 8->38 dropped 40 C:\ProgramData\MPGPH131\MPGPH131.exe, PE32 8->40 dropped 42 C:\Users\user\...\D1SiR_BVePEjKzuadHx_JwJ.zip, Zip 8->42 dropped 74 Detected unpacking (changes PE section rights) 8->74 76 Tries to steal Mail credentials (via file / registry access) 8->76 78 Found many strings related to Crypto-Wallets (likely being stolen) 8->78 90 2 other signatures 8->90 19 schtasks.exe 1 8->19         started        21 schtasks.exe 1 8->21         started        23 WerFault.exe 8->23         started        44 C:\Users\user\...\zDi5_AnRQpJszWGhtVDPo4q.zip, Zip 13->44 dropped 80 Antivirus detection for dropped file 13->80 82 Multi AV Scanner detection for dropped file 13->82 84 Found stalling execution ending in API Sleep call 13->84 25 WerFault.exe 13->25         started        86 Hides threads from debuggers 15->86 56 192.168.2.5, 443, 49703, 49705 unknown unknown 17->56 58 192.168.2.14 unknown unknown 17->58 60 239.255.255.250 unknown Reserved 17->60 88 Tries to harvest and steal browser information (history, passwords, etc) 17->88 27 chrome.exe 17->27         started        30 chrome.exe 17->30         started        32 WerFault.exe 17->32         started        file6 signatures7 process8 dnsIp9 34 conhost.exe 19->34         started        36 conhost.exe 21->36         started        62 www.google.com 142.251.40.132, 443, 49711, 49712 GOOGLEUS United States 27->62 64 142.251.41.4, 443, 49758 GOOGLEUS United States 30->64 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.117.186.192
 ipinfo.io United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
172.67.75.166
 db-ip.com United States
13335 CLOUDFLARENETUS false
142.251.40.132
 www.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
147.45.47.93
 unknown Russian Federation
2895 FREE-NET-ASFREEnetEU true
142.251.41.4
 unknown United States
15169 GOOGLEUS false

Private

IP
192.168.2.5
192.168.2.14

Contacted Domains

Name IP Active
ipinfo.io 34.117.186.192 true
www.google.com 142.251.40.132 true
db-ip.com 172.67.75.166 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YJbhGM-Py7EGIjAcQKAitKqMUDtLRvKqfuyC23FhLvjISe5YubFOHGlwiTqxFBVIZH0lidwOcKuqd9YyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM false
    		high
    https://ipinfo.io/widget/demo/191.96.150.225 false
      		high
      https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0 false
        		high
        https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YJbhGM-Py7EGIjD8QrEj1gFdvHchlLTa-4si6HNrr72UxT2vpiqG82uHrppu3FZXoKV_deHD3oWlfcwyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM false
          		high
          https://www.google.com/async/newtab_promos false
            		high
            https://db-ip.com/demo/home.php?s=191.96.150.225 false
              		high
              https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw false
                		high